Extracted

• • Target
    5b19b82cb9f2bfcd7ce855b32ae5c458aef88e83438a4a7fd292d58af91936a0
  • Size 45KB
  • SHA256 5b19b82cb9f2bfcd7ce855b32ae5c458aef88e83438a4a7fd292d58af91936a0
  • MD5 afdd9e008114d69f0baf17b28e756152
  • SHA1 094c16b477b5be994c88fc93fd2dd6450bdcb7c2
  • SHA512 b889c4712ce78cf4cd93a40316573a8aac8f1e8e284cadfe95a3f825c37433d8f2e786fa49dafb358b808a34dad8c786d24cdf9520de6c9f631c3a5580714cbc
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qADxJdxrPHuPIbzjbLg43iVkk4N3wQDiBDZcx:UuKWgSJTwRf2TxR3b3b04Sakg37Idcx
  • TLSH
    T1BF231A003BE8C22BF2BE4FB8ADF26145867AF1636603D5492CC451DB5623BC586426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2