Extracted

• • Target
    48aade414ae2f953ac9d2f68f0fe442140f85704ab3b49a5b70274b535488a6d
  • Size 45KB
  • SHA256 48aade414ae2f953ac9d2f68f0fe442140f85704ab3b49a5b70274b535488a6d
  • MD5 6e04736ca7b083a5aa7fc48515d5675d
  • SHA1 646f715db938da0a19f0c6fa881e08e94f59cb45
  • SHA512 4d3636286778b43dce94cd464ab5c4f225e7adb27a6b59e3cbe7861b3adeb56cb202f69e1201a64b32956c7bf24c1d2ebd8ec724d59121dc6d328b0d09f412b1
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNK9wa0y/zFOPIuzjbUgL3ik1yoWZpJoBDZ0x:5uSy6pTpoo2HCdi3u3b7LSNoWpJOd0x
  • TLSH
    T1B5232B0037E9822BF2BF4F7899F26145867AF2633603D6491CC451DB5723BC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2