Extracted

• • Target
    c48623df0621f75dff2a9feb8cf35d9cf68de488a86b10bdeaf58ed46789c620
  • Size 45KB
  • SHA256 c48623df0621f75dff2a9feb8cf35d9cf68de488a86b10bdeaf58ed46789c620
  • MD5 619d119ce11d429252fc6a7d1fe4ae3f
  • SHA1 d5a2e2280833859c3f25690a67307d3df11f8ad1
  • SHA512 daddd91a034532facdef9f4bfb7b13b94c8f3cbb076abdc431ec74502b919c4129ab2ee2a51fa579534abe1a27d1291879d74caf964dc01abcd514264b7f60c8
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNi9YSkqXzNOPISzjbjgE3iRePFsqD+SDAdTjf0yBU:5uSy6pTpoo2PaVq3S3b8ESRaFt+RdTj8
  • TLSH
    T10A232B003BE9C12BF2BE5F7898F26145867EE2633603D64A1CC451DB5713BC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2