Extracted

• • Target
    47bf3d0badf783e7ac382de964634c4e272c552da3b8920cf069c51f6ad3eb4c
  • Size 45KB
  • SHA256 47bf3d0badf783e7ac382de964634c4e272c552da3b8920cf069c51f6ad3eb4c
  • MD5 5f3e4f2b4174bceb258755eb1a34f037
  • SHA1 5d675f98e6a389d492d970e6b4d86d62dbee76a7
  • SHA512 a2b967fde6d786cde5650e90f8e23d69cef1c9c7a65889703b2b00b3d8ea228d04525b2a8a75b25f06f3c7a1002ccc0d5b25a42fcacd131df894485f9a251fe8
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1fLiE0yFjrdj3kk8PIhBjbggX3i9ue4DIywBDZUx:cuR0JTPjY2SLBXDBhRbHXS9f40ymdUx
  • TLSH
    T1D6232A003BE9812BF2BE4F7869F26145467AF6733603D64A1CC441DB5623FC69A43AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2