Extracted

• • Target
    492744a8bd7ba804c5b666913b988965c2a6141a74ef2d46630e905b55353309
  • Size 45KB
  • SHA256 492744a8bd7ba804c5b666913b988965c2a6141a74ef2d46630e905b55353309
  • MD5 f7922ce8851c52ecc707c1cf9ba8d553
  • SHA1 e4f179c9b04a9694804d7ca47071cb7df9981407
  • SHA512 d6f5d9b66132705a0424a99bec4b0c0d85a681ff9e8ba51f191ce8320249f6e7a1b2845d26d46c9caec1138b87a29fbff8ff5421f40b9e654dc5f54b21db7cb9
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q95dR3aI6OPIuzjbagR3ifhE6wBDZsx:EulCJTHl42mjqb3u3bNRSfwdsx
  • TLSH
    T1C4233B003BE8C12BF2BE4F789DF26145867AF6673602D58E1CC451974613FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2