Extracted

• • Target
    4a37d8373cc82be44e194a1784ee2fd3e1baa093cfb7a1e01a3ec44fb708d187
  • Size 45KB
  • SHA256 4a37d8373cc82be44e194a1784ee2fd3e1baa093cfb7a1e01a3ec44fb708d187
  • MD5 1437bceffdd5126a08310d2ab1aef7b8
  • SHA1 8c0c38d998ce803f9677721fcd93cc93a671cd8d
  • SHA512 e43ec05f0fb7413f651dba0d7afad8188b111d2dee0f2cc2f68b4498fc65c8c72e28024234874b41a7ecbc6e301b2a570d6549878986669f895e805364622098
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtSCSwTMjPIuRujbbgX3i23sgzThAuiBDZ0x:5udApTNmU2lg1uRCbkXSYAucd0x
  • TLSH
    T1D9231A0037E8822BF2BE5F78ADF25145867AF1673A03D54A2CC451DB1623FC686426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2