Extracted

• • Target
    47e0449c9572100b4ddf659e44fc1201034c705f9f3dbff41cc9e6bbeb3ef2de
  • Size 45KB
  • SHA256 47e0449c9572100b4ddf659e44fc1201034c705f9f3dbff41cc9e6bbeb3ef2de
  • MD5 ca5a67603f196b312e707037e2fc8ec6
  • SHA1 6a099627c0eb059d94cd45501be26d64327c3da9
  • SHA512 2aefb178af40df4be2007428c1bd2bb6b5d25a1c410ae31e061f1aa30b0c2901fd68358cb228228d00c4df884a28593f6a8a69bca724e0b4c80a68a377a45676
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFFeeXKSocbbbQtN8/nPI6kzjbjgX3i8rn4PRdAomTM:cu7e5TH2A2deH2tNKA6k3b8XSGSw/dUx
  • TLSH
    T1A9231A003BE8812BF2BF4FB859F261458A7AF1633603D94A2CC4519B5713FC69A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2