Extracted

• • Target
    525248d4b68b23e5ed2afde5e06823fe8aa186a49ed6324af684286ae8cdd99a
  • Size 45KB
  • SHA256 525248d4b68b23e5ed2afde5e06823fe8aa186a49ed6324af684286ae8cdd99a
  • MD5 f57d540b2e187e0b9b0712e4deee1ebf
  • SHA1 7947e6f9112b68bc06beb70d8c9150fda214a94e
  • SHA512 ad610832bc2339e5ae841c9812f2187e008282158204393a624e073f2156c86eae0271a36b32ceefd8c0097cfa4ae450593c25ee34300cb5836bb9a867d25cdf
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNC9Yq3q3hOPI2zjbOgX3iowZ7AFAjeJBDZ0x:5uSy6pTpoo2/aCq323bxXSXAFxXd0x
  • TLSH
    T175232B003BE9C12BF2BE5F7899F26101867EB2632603D5491CC452D75723FC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2