Extracted

• • Target
    47ef7e06882a1e0f4ba4f42a1c1c82dd80149f1d9cbed5f22495aa9658e5f3e0
  • Size 45KB
  • SHA256 47ef7e06882a1e0f4ba4f42a1c1c82dd80149f1d9cbed5f22495aa9658e5f3e0
  • MD5 7009d4613e0a9a73b1b5a5aba1d963c3
  • SHA1 3bb2e3b3b5d3abbecffb355ae443dc28a031e985
  • SHA512 a266a67950e74a72c615e0d1203069f3635189ba544ed2fa353608743141c6b2c0d7d5f64008608d62a27db082f9af244de1b4795b41783bc68a65a09aaa5fed
  • SSDEEP 768:MudApTNctooWUS7C+mo2qtsGFZQjB4PIFfzjbOgX3ienVu1PIAbRBDZIx:MudApTNmU2kqF9Ff3bxXSeWPISdIx
  • TLSH
    T1DA232A1037E8822BF2BE4F789DF26105467AF6637603D68D1CC441DB5623FC69A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2