Extracted

• • Target
    50a2bc4565032c13dc295d9dde805725c0c9dd2cde3451568629a4211e91ebf5
  • Size 45KB
  • SHA256 50a2bc4565032c13dc295d9dde805725c0c9dd2cde3451568629a4211e91ebf5
  • MD5 a4311019590d1002e6a88a66ad52d637
  • SHA1 e45f802210e515a10794d77fa4091d811b3854e2
  • SHA512 b9bc9e5c8a0f50de2790a538b6b975cb2f19904dc88bc8a0834350a999b1f61acc0ddf382d7bffdb645378377ffd6f936a6285a49c8784486028f3136cbddae2
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFY3vO4iZMOPI0/zjbZgm3iTyfxktr2csaOCpBDZEx:MuLAZTnbg2RmNM30/3b2mSTqktr2cso0
  • TLSH
    T172231B003BE8812BF1BF5B78ACF26145467AF6636603D54E1CC452DB4A13FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2