Extracted

• • Target
    434613f1186e04d5bf383fbd339ffb35f4cfd9e25494fa72b41ceae8177c607f
  • Size 45KB
  • SHA256 434613f1186e04d5bf383fbd339ffb35f4cfd9e25494fa72b41ceae8177c607f
  • MD5 3db90a23fb7cd86b2a52654564674071
  • SHA1 cdcaa4e06a0a688ddeedefd483d0a2784c00f346
  • SHA512 6cf4ea59fb97d6fdd7fdb384705b3b40c2b59d9371aba687aa100dcd4cb83a41564e01c25f7fa76c01d6409560a30e6131291306b4136ed5d1407ecf6f18613c
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qF53FoDEaOPI+zjbrgX3iEz6DkItiNtBDZEx:MuLAZTnbg2UKEa3+3bUXSY6DkTdEx
  • TLSH
    T1E6232B003BE8C12BF2BE4FB8ADF26145857AF5737603D6491CC411975A13FC69A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2