Extracted

• • Target
    055733da5d43eab9500638ec429b85756317c567a01d1dc65a2f81b585953173
  • Size 45KB
  • SHA256 055733da5d43eab9500638ec429b85756317c567a01d1dc65a2f81b585953173
  • MD5 685d468079189819e5ebb51338eef6cf
  • SHA1 1b4f2a5a08a41d4067a0b87177c2773a33f7056c
  • SHA512 5934544bc2e843bba31c08e93257976a3c72ee477c23cae63c25667e5874c1be038fb63c538ed074f97cd8ad1d42df8328b4e5f1f3b2646a8f7bc55eedc67171
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qY2W8aIXOPIKzjbVg+3iCf2YVsNnBDZ0x:8uuSpTgyf21Fu3K3by+Su2YiPd0x
  • TLSH
    T149233B003BE8812BF1BE4F7898F26145867AF6677602E54E1CC451DB5613FC68A42BFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2