Extracted

• • Target
    4241afb2e1fb2f398786a1d40a8c36b0e8dec9f876905bd412d813c837e061a4
  • Size 45KB
  • SHA256 4241afb2e1fb2f398786a1d40a8c36b0e8dec9f876905bd412d813c837e061a4
  • MD5 a51897bec7b86fc319191583fafc12d5
  • SHA1 24173f9d11fa0e537dc8713b9a9225beb7f644b5
  • SHA512 8c1db2a1bf00898f6dccb241342a66c01d7040d98d97c69792a72881c7e001faf4536a63a4fa501105d56bf74f31658d36c274eea275df7c5c613601accbbe86
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9eMcYssiJoOPIcCzjb1gXyiqA33YlaFcABDZ8x:0u1YJTHcw2RnlG3cC3bSX7q4TFcWd8x
  • TLSH
    T129232C003BD8823BF2BE4F7899E26145467AF6A73603D54A1CC451DB5713FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2