Extracted

• • Target
    b50a46c519a07bc68d998d3480fb5fc2fead434353f16da35cdf6d82721176cb
  • Size 45KB
  • SHA256 b50a46c519a07bc68d998d3480fb5fc2fead434353f16da35cdf6d82721176cb
  • MD5 e6d9e6b8b65abd9bd2da319fe0d4e90c
  • SHA1 455a8907c7c2a918832de0c0c9e6c1d47c13c67b
  • SHA512 bd0573e7a64fbe70a25c341f28ada6f53ac946452f397af32faf3f6c01a399abc73682ccc32eccde06f2287532ddd5e036f56a21f2bcf231c52c433f66b5aaf2
  • SSDEEP 768:cuqb5TrIGuCWUoKXMmo2qQ0fBohEa+PIvBjb2gX3i28AM5/noHZ+BDZUx:cuqb5TrhG2a4EaHvRbpXS1aZQdUx
  • TLSH
    T13C232B103BE8C12BF2BE4F78ACF261454A7AF6636603D5492CC4119B5713FC69A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2