Extracted

• • Target
    014948d513d7e7a7c61fcc81bbf3bda67ef3c8975f3fb842e53b9e3ae19e1afb
  • Size 45KB
  • SHA256 014948d513d7e7a7c61fcc81bbf3bda67ef3c8975f3fb842e53b9e3ae19e1afb
  • MD5 06e428d30b502bb585ed9eef5c124618
  • SHA1 50f0a74ebd3bd6a9d23ca6125803c68a36dd3aa8
  • SHA512 9a6eebfde616a03b10cf2fd08f12d063dea7e87eb8b3cc78916637e46ae60fe5f86f42d7a1981abfc01435cf2e445c027c0cdf27fc84f27f53aad4a0f8935883
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFg3Fo9EaOPItzjbIgX3izv4yvUhnVcBDZUx:cu7e5TH2A2R8Ea3t3bfXSU1OdUx
  • TLSH
    T192233C003BE8822BF2BE4F7898F26145867AF6637603D54D1CC452DB5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2