Extracted

• • Target
    b49e9586f50a877663fa38d804306d5766a7f6c8127f3d0a2c5392f2ea7b4457
  • Size 45KB
  • SHA256 b49e9586f50a877663fa38d804306d5766a7f6c8127f3d0a2c5392f2ea7b4457
  • MD5 cf32a89b97af58ef2a599282634e3bd7
  • SHA1 7e82b3d5ec910b6310dff42063a126b24fbc196b
  • SHA512 bf1f1684b06d6f6cd464cd6ee4b93032fc881e7835a0ee8efef9cb59d705db811f85c57e0a046d2fa23cc8b8320d68a7116ef9c5b1a693e02826219a97b02d25
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlI5dTQy06SOPIMFzjbMgX7itdM/nO929UaFIJDv4:wuDWZTpMZSB2zmaS3MF3bDXWnD2qaFIW
  • TLSH
    T1352329003BE9812BF2BE4F78ACF26145467AF2632603D64E1CC451DB5613BC6DA526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2