Extracted

• • Target
    47aa5a4e935e094d6a17efdee4ab9b765a402546d2ba994a415b96d33b5c6f90
  • Size 45KB
  • SHA256 47aa5a4e935e094d6a17efdee4ab9b765a402546d2ba994a415b96d33b5c6f90
  • MD5 0aa1fc5bdb36ceecd10846c4389a41cc
  • SHA1 28a4af36e94ccec4880638b2873425ab2ca5a614
  • SHA512 55d786e083021db95a4d9a391dabb35055cf58bc5a9ce6a7b9ae6b3c2c6927e2a6822c66a21a3cdb8404952841096ff741adefcb26db7e8b38a1e00535e83f64
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qY1wzBNMwpGPIMPzjb0gX34sQNEEfMTd2F6lBDZ0x:8uuSpTgyf2dWGYvMP3bbXIsQdAs0d0x
  • TLSH
    T1CA231B0037E8822BF2BE4F78A9F26145867AF6633603D54D1CC451DB5613FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2