Extracted

• • Target
    047994c4490a750176ae4e1fde0506a984727ccf773e52b672abab4763f5a563
  • Size 45KB
  • SHA256 047994c4490a750176ae4e1fde0506a984727ccf773e52b672abab4763f5a563
  • MD5 fba8ee2f69e3e42dedaca8873146f8a7
  • SHA1 9a5cdbbe2eb93e4a2fa42f2dd4c285092452361a
  • SHA512 aeb3606e27c45ded5aa04e91cfab61e6e5bdd5615f6571da30df9be6d98989534ade40a29152d2d7053c53837683df910a625ce006af82f89d0c7139e49536a6
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qldeeXKSocbbbQtN8/nPI6kzjb5gX3i1M2CY6k7B8:wuDWZTpMZSB2FeH2tNKA6k3bWXS1/+k6
  • TLSH
    T12A232A003BE8C12BF2BE4F7899F261458A7AF6633603D58A1CC4519B5713FC5DA42AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2