Extracted

• • Target
    4c2fafe9aea548e30a1b144feca50b3a44b925733cba6c5f31794fc4bda17880
  • Size 45KB
  • SHA256 4c2fafe9aea548e30a1b144feca50b3a44b925733cba6c5f31794fc4bda17880
  • MD5 3a235797681982a95715203bd8bf4389
  • SHA1 a280b43f45b6793119a2c291665d3fcf498fa612
  • SHA512 0f8b783de17c4bf93e03238c0d6ef14d8bb106861a529484bd44bdc73dc1d357475cccd6d71b30b34b3cf0fb5c6e4b2e8eb2f632309017426cf1cd26755f6797
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9LqAYaayNPIHzjbOgX3AcVG2gDRXBDZsx:EufspTf2g2WqzqqH3bxXQcVG2sRRdsx
  • TLSH
    T156231A003BE8812BF2BE5F78ADF26145467AF6633603D94A1CC4519B5623FC686426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2