Extracted

• • Target
    4d9d6cdf7f0d23689896ccdf415fdc870e96aff3ee8b31dc5df102b6bcee8005
  • Size 45KB
  • SHA256 4d9d6cdf7f0d23689896ccdf415fdc870e96aff3ee8b31dc5df102b6bcee8005
  • MD5 f6efaa2d35f777d4d507b9bc31b7fad1
  • SHA1 ad889cf2bb9bdf6b23dec4dd4aee82e4163477dc
  • SHA512 73e63b3107704a01b8bc3c5846ab10f25f9c0ef2121b50574df7a2090a8f9930287c275e230fc42c3eb3e5a5af8b423961970986b144519c296eaae69d0bd8b2
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1fL5P02FUFdxYkk8PIizjbAgX3iiZCWbgXKSHbKBDZW:cuR0JTPjY2SLDmWBi3bnXSiZCl37UdUx
  • TLSH
    T1F9232A0037E9812BF2BE4B7899F26105867BF6736603D6891CC441DB5B13FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2