Extracted

• • Target
    47191eb67baee4315d4cac62732fcee49dfcbaa8bdc7afa64cca3378c50d6194
  • Size 45KB
  • SHA256 47191eb67baee4315d4cac62732fcee49dfcbaa8bdc7afa64cca3378c50d6194
  • MD5 47400a7a4f64ca8f29be7eef92a41fce
  • SHA1 9c8d3aa99c1bd2267e59887207a28c947202d48f
  • SHA512 73c393204e10700016cd9b1114567baf1f3d84959dc1c8e517ef362106bdef13c425543c572549d3825062667768c2730bc96b3470ccde6077c34c52a4a641fa
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qV2maPcl83APITpzjbngX3iIKSUWQ/96gYPBDZkx:suJdpTPdI2HfcS3lTp3bgXSlSUWQ/9uk
  • TLSH
    T169232A003BE9C22BF2BE4F7899F26105867AF6637603D64A1CC451D75623FC29A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2