Extracted

• • Target
    4ec928e54fe3d117207695fe2f8080d5af492c9c22ae0a164572ab5b6f3b10d0
  • Size 45KB
  • SHA256 4ec928e54fe3d117207695fe2f8080d5af492c9c22ae0a164572ab5b6f3b10d0
  • MD5 ff5e40d2c6b45e364d84d0dc75a81f3e
  • SHA1 dcb57457d277d4c3ab392ab22de36342518a6a8d
  • SHA512 b6081feaed232e32763f14158685a4bb5772a15bd537b3d22e3fc1b50b9d266833ba4f32af0c35c3d7b89b0633a06cde46d2a80bf4702f6b01b82f77593a469f
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9KRzMwcOPIgzjbogX3ivnnUQHs5JKTKxzS15mBDZ8x:0u1YJTHcw2bAd3g3b/XSBQJKTKxood8x
  • TLSH
    T195231A003BE8822BF2BE4F7899F26145867AF1672603D68E1CC451DB5613FC68A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2