Extracted

• • Target
    50a27ce74c2eda59e46055ffa76f65969fa4107d9b76a80cdc7293f9f8b183be
  • Size 45KB
  • SHA256 50a27ce74c2eda59e46055ffa76f65969fa4107d9b76a80cdc7293f9f8b183be
  • MD5 3e76ad764401be81ddfe31b6ec9cb4ff
  • SHA1 6af2395f7cbd9d138e2d97dcd9d17204520cf0ea
  • SHA512 bcb4100f5541f32b450bcd833aac13d5d4768fa9c96432c747a92ac671f54ebcb491891a739f0e7c48983e42d52a13297aee8dd4a039db8c2c345a54fd5e7b12
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFENd3u40cMOPI04zjbLgXwi+6hlaDh0YNBDZUx:cu7e5TH2A2T8+M3043b0XN+6aOYDdUx
  • TLSH
    T161232A003BE9C12BF2BE4F78ADF26145867AF6632603D54E1CC451DB4613BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2