Extracted

• • Target
    47606b6f071acf06dca08de49dfee442e675811ff94e7d4e5523e53ec2a8d56a
  • Size 45KB
  • SHA256 47606b6f071acf06dca08de49dfee442e675811ff94e7d4e5523e53ec2a8d56a
  • MD5 339a172932eeef2ba47c961c25438946
  • SHA1 9679360221740b050c025a2e29ed98ba28c80d40
  • SHA512 21f93b0732fed32f0394a549f31ee6b63e800660b450e802f9c2bf1cc689622f8b6dc4967dc0c18c61243d2b7c78f6880f302a275dabb12dc364f99259d2e00d
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9b9YikqHztOPIUzjbjgY3ioVWRgovcQruwWBDZsx:EufspTf2g2WalK3U3b8YSwZQr6dsx
  • TLSH
    T1A2233A0037E9C12AF2BE4F789DF26145467AF2A33603D64A1CC452DB5713BC68A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2