Extracted

• • Target
    492f2fe3e47ac9983d1d7695911643d54e671fbb18bd2100b6f22ff1d214ebc0
  • Size 45KB
  • SHA256 492f2fe3e47ac9983d1d7695911643d54e671fbb18bd2100b6f22ff1d214ebc0
  • MD5 2bbb335418e51d5fc8ed6eeac63368f2
  • SHA1 6ae9da8bd40f343b8c75f5a2cd0abeb1e2e07e17
  • SHA512 b8c65429c757a2b978ab59a0b778169f7757403a571e723cd23ca5348d845d3ff35fc4955b29d647ad8ebad44fc7d7304de1fb28b9091f3cb40204756acf30a6
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1Jw0QbKXPIPzjbRgX3i0dXV+2DF4rNNVV93AZBDg:cu6YepTPso228P3beXS0lQ2DFCQdUx
  • TLSH
    T157231A003BE88236F2BE4FB858F26145867AF6732603D64D2CC451D75A23FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2