Extracted

• • Target
    46eeb37dac35e2996c5940a0f2f48e549a9835441f58b0a72d64dd14cfc6e148
  • Size 45KB
  • SHA256 46eeb37dac35e2996c5940a0f2f48e549a9835441f58b0a72d64dd14cfc6e148
  • MD5 2c884a7c2afc12dee2cc84152a7b908d
  • SHA1 f6c06d58e6ab6a6051061576a63ad3a46e6f686a
  • SHA512 ccf065f8afd65cf0d4f2f5912ae22d262d50a712f438a330ec1a6d07d1ca0758c836be4f405843c9fecf5f8d65dec410b0a670ecf26fba82d283e4eb2fd96f0d
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVtBzwQ/x7PIPhjb8gX3iv9QAzw8Xr2zTBDZkx:suJdpTPdI2IaFPxbTXSv9b2Bdkx
  • TLSH
    T193231B003BE8823AF2BE4F789CF26145457AF6636603D94D6CC412D75623BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2