Extracted

• • Target
    046ea81c81992cfa99d6368333f745724489656137d0897281861a54c8285db6
  • Size 45KB
  • SHA256 046ea81c81992cfa99d6368333f745724489656137d0897281861a54c8285db6
  • MD5 46093fc3b43ded3944d71af294118b35
  • SHA1 1e5c5ee4c0be0cda0a246869bca96e5b02ba6e21
  • SHA512 5cfa222f9d808ba611dde1307935617d8d8156e296914ae63d220a17ac566319f6c69e2478936c39f3027160d7ba66b5e423b88787ea63ea312aff34c2528de1
  • SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qACL5P02FUFdxYkk8PIZzjbrgX3iHeh0myCaANgArf:cuqNJTLr62yLDmWBZ3bUXS+h5yCaAxum
  • TLSH
    T154231A003BE9C12BF2BE4F7469F26145867AF6736603D9491CC441DB5A23FC68A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2