Extracted

• • Target
    048bbfd724ae0579cc54b40a0574d9e07f5c6371109ca65507041f4b55cb1aa6
  • Size 45KB
  • SHA256 048bbfd724ae0579cc54b40a0574d9e07f5c6371109ca65507041f4b55cb1aa6
  • MD5 041f7f866aafa1b815b7fbf8caeddeb9
  • SHA1 bff93b80db9704ea29ade15532e1fd9106fccb73
  • SHA512 8fb609e6d5e58dafddc11c4097b0c57ff82468d07750f318a1c9fd7d8787db102ebe98eab8ba780a1810c405b0dc7b1740d7b332491affe7c3102797b0693bc6
  • SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qrbT2Qpm7PIKfjb6gX3iAby5sOQF4BDZkx:vuogpT7I62beKrbtXSQws9Adkx
  • TLSH
    T11E233A003BE9C13BF2BE4FB859F26145867AF5632603DA4D2CC4119B5623BC6DA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2