Extracted

• • Target
    5899aec8771f1eaf2c1dea44491f079f42b87c07d5bac6109003ddcec636e088
  • Size 45KB
  • SHA256 5899aec8771f1eaf2c1dea44491f079f42b87c07d5bac6109003ddcec636e088
  • MD5 42b563fbc37d453a64892ca1045d3ca6
  • SHA1 b116841b8d83daf4983fdb08846e47865e923f5d
  • SHA512 4030212562861ac716a8f79efbe4b533e71bd2cfef8d6088b59e1fe60fba9c3b6f457dfdc7b8c972498b9f1572ea641d800968dcef567f03be566c9d2e79700f
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVcqyE0OFUwdJxIkDPIBzjbtgX3iIzqj8nBDZEx:MuBGJTPho2tqNTLMB3b6XSIzrBdEx
  • TLSH
    T1AA231A003BE8812BF2BE4F789DF26145867AF6736603D5491CC441DB5A23BC69643AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2