Extracted

• • Target
    49e2901b8f0fd2c7aab414ae2c61deee80d3e2191cced72f8547f43cb9db222b
  • Size 45KB
  • SHA256 49e2901b8f0fd2c7aab414ae2c61deee80d3e2191cced72f8547f43cb9db222b
  • MD5 e50e7049e2cb3b97bfefc483d4aaed4e
  • SHA1 618ed135bdea8e5836e7ffff8b0e078bfdd24e56
  • SHA512 98b7ee3e3c5b8c05801928aa5dd9176e7b2401b17a1c564e7c0790ad709f2737a8a4cf7978fb588ba58c668b973e89587348afc59446bd23413b3b76ce1def50
  • SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qjLSz8yfzuOPIhzjbkgX/iZy5OXe0oMQD6BDZ8x:0u2vpTDe+2gSQJ3h3brX6ZyIe0oMfd8x
  • TLSH
    T158231A003BE8812BF2BE5F7899F26105867AF6632603D6491CC451DB5713FC6CA526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2