Extracted

• • Target
    e42949a462206242af751e0f3b1e7cb4200328fdaf74a6a5e7d0703b01dd2d66
  • Size 45KB
  • SHA256 e42949a462206242af751e0f3b1e7cb4200328fdaf74a6a5e7d0703b01dd2d66
  • MD5 643cef05b4697b7d00a57676eb15a548
  • SHA1 0b3398662c92d53dac0ed1af270a0ba60a3056a1
  • SHA512 c0548296dab53889af94b90d90d739de89f2e2f18d98d06ea4394a0e387ec20b7285256b3528f76ddd2988a55d9e1877da2fc69c5c47c61dd8412d2fa308c029
  • SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qjoO5QPCBAPSNjPIRzjbXgX3iJbVlCgEeVyKjjfooXU:0u2vpTDe+2vO5svSKR3bwXSBygEeVjcX
  • TLSH
    T1CA234C003BE8C12BF1BE4F78A9F26145867AF6632603E9891CC451DB5613FC696426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2