Extracted

• • Target
    48a83986f72fee9d38a75fe9a22e1cdc73eac8228fed245bf2ce58d8baeb5de9
  • Size 45KB
  • SHA256 48a83986f72fee9d38a75fe9a22e1cdc73eac8228fed245bf2ce58d8baeb5de9
  • MD5 f3fce2ab52152747461daf6d10c22c0d
  • SHA1 be2fae3b235aa07875243b7c0335ab2044c7b64d
  • SHA512 1c11515c4c4ca6fd96a3b8c247a7ebab04e8be811bc15515a75079dc816350a1906dc45f3f76b02476f4edb26c163fddf18d86f3e3b2c7073622f43ea1d66e71
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVh0e3NEAKViZPIazjbWg73iTw1qWZZnpEp73duBDZG:MuBGJTPho2E3exiWa3bJ7STcZggdEx
  • TLSH
    T1332329003BE9812BF2BE4F789CF26145867AF6672603D59A1C8451DB4713FC68A43AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2