Extracted

• • Target
    4e2b4311b1256afefc584d91fcdbaf2c298151d156f007a0a89ff5a601831c3d
  • Size 45KB
  • SHA256 4e2b4311b1256afefc584d91fcdbaf2c298151d156f007a0a89ff5a601831c3d
  • MD5 f8291cb6cd991f89ead093ece8982a05
  • SHA1 98de91e292585bc06fc3c7fddf45e433c419fd65
  • SHA512 f2c42fa58e4b00f59b5369d606d17a017c6f871a1286ee7fcbd80c0f76db695d6a3aa52d7896f33da5188229417d6901c8a0a72353e895a989da27f218aa96e5
  • SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qrbT2QAm7PI1gjbZgX3icOl02XialYl1gcuhBDZkx:vuogpT7I62bT1Ib2XScG02Xiaelzufdm
  • TLSH
    T1FB231B003BE8813BF2BE4FB898F261458676F6636603D94D6CC411DB5623BC6DA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2