Extracted

• • Target
    48a9ee14ae60ec0b97e3dec1cb3a05eb2d7535260921ce6c7bf0049a7a430e6b
  • Size 45KB
  • SHA256 48a9ee14ae60ec0b97e3dec1cb3a05eb2d7535260921ce6c7bf0049a7a430e6b
  • MD5 4933653dbb1e6aa6975914e6b5911747
  • SHA1 627aa4ff18f929ed2070607bf06bd0d684836bc1
  • SHA512 769c8849635bbd3f1419bc6d9a28b14874cc1c4f27b27a0ff9b13041d0578172c0c2752990ecb24b45c259334319b4b055254373976377767a0a2afdc62c718a
  • SSDEEP 768:Iu5KkpTsU6Q8WU+xjamo2q1RxJaxjwHuPI+zjbvgm3iotFCDi2Ro/BDZLx:Iu5KkpTsx/24e+3+3bYmSotADiBJdLx
  • TLSH
    T180232C003BE9812BF2BE5F7898F26145867AF2632603DA4D2CC451D75623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2