Extracted

• • Target
    448818d1c9c40d5ded35c244353a00cc961c2166cd158ab3ccdd08badd74ff36
  • Size 45KB
  • SHA256 448818d1c9c40d5ded35c244353a00cc961c2166cd158ab3ccdd08badd74ff36
  • MD5 80e5a4b302d2430690582846fe3131aa
  • SHA1 a40a0176677ecee84d285a78636ae4b2f3db2348
  • SHA512 52bbaa58b0bd2b3302820adeb3615f2ecb82b065e5609e3527bf36a4978e12a6ec3308a397b94ef59c04ef0f3a240ab7ab8f7d1b71dc39ce7913d0aa1d4630d7
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q97Iz/yPqiPI2zjbIgX3iNLelTy3ytm2BDZ8x:0uPrpT/qY24c523bfXSNm+Qd8x
  • TLSH
    T192232A003BE9C12BF2BE4F78ADF25145467AF5633A03D54A1CC412DB5613FC69A42AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2