Extracted

• • Target
    56d86d5fa7997558f7dcee70102a13f55f1d0c0351e16ca69ce36ad5486bb995
  • Size 45KB
  • SHA256 56d86d5fa7997558f7dcee70102a13f55f1d0c0351e16ca69ce36ad5486bb995
  • MD5 d00508912e439f1240b35123c47d2dfb
  • SHA1 2ade6096c09d0a91491929d437d0479933c28aae
  • SHA512 77a2ecf05f2f96e011c668bf50b422becb51f0fa9408f59053345953d92605361d3a7b9faf31393be10863ef31f617992972652a4e7e2741456046d14e2c95b4
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1nT9Qpm9PI5zjbHgX3iS9ZFYoOH8z/+FgtBDZUx:cu6YepTPso2GQ53bAXSaeo2y+FgjdUx
  • TLSH
    T150233C003BE88237F2BE4FB859F26145867AF5636603DA4D2CC451DB5623FC58A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2