Extracted

• • Target
    c50fa4fcdf612902088e72f367ec102f608b8d259277b83466dc4568b5c9d18c
  • Size 45KB
  • SHA256 c50fa4fcdf612902088e72f367ec102f608b8d259277b83466dc4568b5c9d18c
  • MD5 64a9bc62de3151e3e3c841cd2a0d9fd5
  • SHA1 bf8236b4fe96d0a9f138ce8b25adee2300e89df8
  • SHA512 b01afea33038ef18217e332b085963efbf7b20f3fb4fbbc334dfae84375d60c0286cec048d44dacedc389bc9bf4850de28ff227fd922df47a45efeb40ce66d34
  • SSDEEP 768:4uLZZTUAoOSWUYZL8mo2qFrfBohEa+PIv0jbxgX3ixq5bH7aNqRN6BDZbx:4uLZZTUTn2a4EaHvUb+XSoBH+NBdbx
  • TLSH
    T10D232B003BE8826BF2BE4F785DF26145457EF1632603D6892CC411DB5713BC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2