Extracted

• • Target
    49af2f6b2f8f375531f1daea2254ab1fbe443ded0461bec2afd56ca2afdb4671
  • Size 45KB
  • SHA256 49af2f6b2f8f375531f1daea2254ab1fbe443ded0461bec2afd56ca2afdb4671
  • MD5 9ebcd24759fe662bda60bf64a25076a2
  • SHA1 c0fa273a323abf621844f276435400be1102dc76
  • SHA512 62edf8560ee600fabcd07bb4a573eb8ffc616b9ae1de2fb7cd2911a5f60854282258d6242b52745489e4b010d75ab8fe54af4322a8bf45a5adf14d6bb18415d5
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9BHO9YjoHPICYzjbjgX3ixnReAUZWhIZrfBDZ8x:0u1YJTHcw2x6kgCY3b8XSxnReAUIhApM
  • TLSH
    T16A232B003BE9812BF27E4F7899F26145867AF6633603D58E1CC451DB4623FC68A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2