Extracted

• • Target
    48cd279522d351cb40cf679434182e00b0d2a6b32e9c62ab0e0f6dea3a057fc1
  • Size 45KB
  • SHA256 48cd279522d351cb40cf679434182e00b0d2a6b32e9c62ab0e0f6dea3a057fc1
  • MD5 79efd430a64fa808f0241ba38086053b
  • SHA1 511be239ccf1474723007530555534f1647944a8
  • SHA512 ecbce3b04ac6efcd09de4f38948f57df20b5bf43f071bf72d957206ab8edfa5647c7dfbba2a6c6b3ead4eb9bff35d2f41409b1f1259238de118dcbeda69bdb20
  • SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qr5w0Q+KXPIgzjbPgX3irVYaR++TgBDZkx:vuogpT7I62Q9g3b4XSryaRfT2dkx
  • TLSH
    T179232C003BE9813BF2BE4FB86CF26145467BF5632603DA492CC451D75A23BC59A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2