Extracted

• • Target
    49e958a2f4f7f7ac2e378bce05b7203e63eeb60f3a44d14919aec1547d4467c1
  • Size 45KB
  • SHA256 49e958a2f4f7f7ac2e378bce05b7203e63eeb60f3a44d14919aec1547d4467c1
  • MD5 9c741ad1dc391edb69f9437ccf9f0822
  • SHA1 bce085b53c6ad6b58a86d99b4e1ee36591afad5f
  • SHA512 ee7356321abb92b5812df94ea8cb9b207ab526b9cce8625d43e0bf4049955e70c40a1fe7e4534bdd223748de640e4990c97bc9b86c123df8f6e4ef1f4a1f3f41
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAmfPLzizpvtLjZPI9zjbTgXAiJxuYxD+gBDZMx:kuSOpTPOP2WfHi1VjW93bMX9JxFHdMx
  • TLSH
    T109232A0037E8C12BF2BE4F78A9F26145867AF6672603D54A1CC451DB5A23FC6CA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2