Extracted

• • Target
    a47c500dd4dca9c220ae4e2800bfcd7cb7166a2fd21ca7e57067aacc183002b6
  • Size 45KB
  • SHA256 a47c500dd4dca9c220ae4e2800bfcd7cb7166a2fd21ca7e57067aacc183002b6
  • MD5 b2e5944581c204f76aa21937794cb62c
  • SHA1 c0cfcd73cf8ae99c1500cc88e6a898a28c7bd557
  • SHA512 6095d673c9ec0c2a2ae7b01e91cdc1278681f5a03fedf55e5832b5f1e51046abfc39e9824d467e75a2bd42d17c2e8739507183021e9e377356efbff83c563b3b
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4ziD8yfzuOPIlzjbKgXhi8gbdp3FpQcBDZ0x:8uUIpT4vAj2niAJ3l3bdXwFbHQ6d0x
  • TLSH
    T1FB232B003BE8812BF2BF5F7859F26145867EB6633603D54A1CC4129B5623FC6CA526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2