Extracted

• • Target
    46aa24d73502ad7bb61c5087ed25b94599547c6674d47d819c762f3be8dbb8da
  • Size 45KB
  • SHA256 46aa24d73502ad7bb61c5087ed25b94599547c6674d47d819c762f3be8dbb8da
  • MD5 7e28ca462403061f0eb47adc1b08871c
  • SHA1 cf1d83fa0b1f976f72c976f1632fa738823c304b
  • SHA512 c2b39c17c8c83c573c4d7a94d5a25c128051ce0a9fa4701c997c544907d2a2a0fc2ea63fba3f2700cb4df0ae5361a8b8710f461cc0533d54eedf1977501665f2
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qY2W8aIXOPIKzjbTgw3irtvtyS+IYk7mo9aBDZ0x:8uuSpTgyf21Fu3K3bMwSrZ+IYk7Vyd0x
  • TLSH
    T17D231B0037E8812BF2BE4F78ADF26245867AF5676602E58E1CC441DB5613FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2