Extracted

• • Target
    a50d58457c0f56f5f444aa7fb82ad56eb7bf416bf4aba4b9de8459b462c7b49b
  • Size 45KB
  • SHA256 a50d58457c0f56f5f444aa7fb82ad56eb7bf416bf4aba4b9de8459b462c7b49b
  • MD5 eced6254487927bc517cd510fcfb1a5a
  • SHA1 af661ed46a929e57137a498aa0c5579b71247ffa
  • SHA512 baff67089d24511da0f2091956d013c4f42145c5ec3b38bf1d0ffe40cda94752997c232e74c6aac3527abc2bde695627bf185998f5b0a993d1cf2c34fd01353a
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwzNd3g4OcSOPI0nzjbLgXiiNMnQXljN06GVgrbBDZO:ku40ZTXEb29CES30n3b0XLNMnQX5+6c/
  • TLSH
    T1BD232C0037E8C12BF27E4F78ACF26145867AF6632603D54A1CC452DB5623BC6DA526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2