Extracted

• • Target
    4e964e7070b4a53c3488e45ed2cb002c230c2d423559f8c13c05347f143ad60e
  • Size 45KB
  • SHA256 4e964e7070b4a53c3488e45ed2cb002c230c2d423559f8c13c05347f143ad60e
  • MD5 b8e912b31c1e1401334df791dfb23930
  • SHA1 055fdfc718a327402e6eb792db8cbae772982052
  • SHA512 35f668f892cac87f0aa136a7a5f276911609760654f20fb34c5bc60870dd0938c0f3454fa3d0e9ce21325aa574dd5cb402cb8ad0bb88c33673c7f9711bb7093b
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVOT9Qpm9PIAzjbygX3icjRvL4VpXAq5F/WJkBDZkx:suJdpTPdI2ZQA3b1XScFL4VpwqF/WQdm
  • TLSH
    T184232B003BE8813AF2BE5FB898F26145867AF5632603D54E2CC451D75723FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2