Extracted

• • Target
    549a4dec0a144c1a79ecd02c449d41d2748092b466dfbdbc821b9e3b6a8e7314
  • Size 45KB
  • SHA256 549a4dec0a144c1a79ecd02c449d41d2748092b466dfbdbc821b9e3b6a8e7314
  • MD5 1ef6c572ce7c41fe1963ac090dae9deb
  • SHA1 e25122c2fef9ef84248086f48165de996714b310
  • SHA512 ffb47a5373b295f8adbeea9ab12ea77df6f0f49dfd9743420b2cc188bb8ff9720f82ccb69fe355f8757c810610a02741406fcffa57d41c175eb5417d305f3f92
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9D9Y6kq/zNOPIyzjbLgo3iq10ZV4zn0bBDZsx:EufspTf2g2Oa9C3y3b0oSuwMQdsx
  • TLSH
    T145231A003BE8C12BF2BE5F74ACF26145867AB2633603D64A1CC451DB5723BC69A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2