Extracted

• • Target
    4e3c9d520d275433f44ebc6f21669b0615bbb10f1dd0b2c758265ce7cecda839
  • Size 45KB
  • SHA256 4e3c9d520d275433f44ebc6f21669b0615bbb10f1dd0b2c758265ce7cecda839
  • MD5 84bb62e75e06f4cd47c8ce9877868545
  • SHA1 24ce9eb81d3d527f3945dbf8389e139ad3586451
  • SHA512 f210d3bd1379db30eb21b9d218291eccf874375530f53d7463046c6fca3ccf9cf6320b29c127f733ccb3467b64ba6f0d8af7ef749feb32e0752435b5df2971d7
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAG8V1yp7EcPIpzjb4gX3iDTJahi7DsYvyHEBDZMx:kuSOpTPOP2W8V41Ehp3bvXSXFndMx
  • TLSH
    T14B232B003BF9822BF2BE4F78ACF26145867BF6672603D5491C8451DB5613FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2