Extracted

• • Target
    4572ef476f705743a0e8c65dc71f950e271d2c00bcd13f97d20a908da3ab39e9
  • Size 45KB
  • SHA256 4572ef476f705743a0e8c65dc71f950e271d2c00bcd13f97d20a908da3ab39e9
  • MD5 2dc94b2ef78bddc09779f6b36cdb7d50
  • SHA1 88fb46887ce907b2be49047327eab3216dcd696f
  • SHA512 468982424e11affd0289ebafa3226be1a5b272db2d4583e0a366c5e35722e0ef61017ae0b5e6e8580b978fc356a456a0009c662e4d3396b611bca3fb8577259b
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFOeeXK5oibbb6TN8/nPI6WzjbMgX3iNBr0pYUgTZu3m:MuLAZTnbg2aeEqTNKA6W3bDXSb0pYZSE
  • TLSH
    T15A232B003BE8812BF2BF4FB8ACF26145867AF5772603D55A1CC4529B5713FC68A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2