Extracted

• • Target
    948b4b2f80c8580b9449ae035e52f000b9110ca1d00cad65529b97bd7c44a1b8
  • Size 45KB
  • SHA256 948b4b2f80c8580b9449ae035e52f000b9110ca1d00cad65529b97bd7c44a1b8
  • MD5 e39f79cf6910edeac71e3ce0f799bb16
  • SHA1 a42cc83c28129e128358b0436ca51b630e8fc156
  • SHA512 fd26a192f4bdcb0d6d6c920da1800349072f747f1eab490894de7c11aff140d7c45132fe88cafdf999c37b14f5bffd7fe5fbfd75f1771721a1b3771b11a90303
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q98ITnyfaaPI1zjbsgX3iCC44UDtGnAzBDZsx:EufspTf2g23Eh13bjXS24ytmAVdsx
  • TLSH
    T1BA231A0037E9C12BF2BF5F78A9F26145867AF6633A03D6491CC4119B1713BC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2