Extracted

• • Target
    48a95a25f4a93fad2dc957aec52db137a299242e2a75d015cfd201e189aa67e2
  • Size 45KB
  • SHA256 48a95a25f4a93fad2dc957aec52db137a299242e2a75d015cfd201e189aa67e2
  • MD5 28e1170eb8c46a5a7ce549cf616893be
  • SHA1 21490c3ebb2f992df8d958a2e1e1e217b3464168
  • SHA512 8204d6e3ae225c4dce016f16b31d7cef2577e38d772b3d3d17c17d6b645861733b4bd5a1388a77fdf3fd5b7de535631401cee24592475792f288994e8af109d3
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1L/7c83APIlzjbqgX3IEdW62jRrON4qRBDZUx:cu6YepTPso2iDp3ll3b9X42WGvdUx
  • TLSH
    T1202319003BE9812BF2BE4F7899F26245467AF2637603D65E1CC441DB4623FC68A436ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2