Extracted

• • Target
    468fa740d016534f95027e9100e7ae00371430ca8fac750fbf6486f6c098f381
  • Size 45KB
  • SHA256 468fa740d016534f95027e9100e7ae00371430ca8fac750fbf6486f6c098f381
  • MD5 b14d6169316e7f5d9d1438fb627d5ba0
  • SHA1 97338c095d1ce9f1ace81c8d314a800880ee7cad
  • SHA512 4ee4b26b8b3bc74350ae4d6257922500a0a2bb63b0b89516c2dd07e292ce7087675652e699e0f821713e9163019c3bdac3e74d4d27bacb8a039b0ba272a95a95
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qY2CwyTtUPIPzjbZgX3iJ0sLg0oOXoBEbHpFo6BDZ0x:8uuSpTgyf2uE7P3b2XSe6JoODHpFpd0x
  • TLSH
    T1C1231B0037E8812BF2BE5F7899F26145467AF6633603E58D1CC4519B5623FC68A42BFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2