Extracted

• • Target
    58df1ea2a5aacab07a531b555384947075b3fcd401ad8bebd0c10fca20534a38
  • Size 45KB
  • SHA256 58df1ea2a5aacab07a531b555384947075b3fcd401ad8bebd0c10fca20534a38
  • MD5 ce98496b5d0fa4ceeefa828f7ab57088
  • SHA1 23ece56b18357d9529fc75e538b14c6e9bf5fab6
  • SHA512 4c05185da4ae654f7d7ff8ebd6494115d4c877e8a92e11e91a52940c205a86d81c2e719adcd3acbb3b4f15fafdddb764c051a0bd9edf948cf5637a96729575b6
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwIeeXKSocbbbQtN8/nPI6kzjbvgX3iBn9g9N6qBDZO:ku40ZTXEb2VeH2tNKA6k3bYXSZ9g9N6X
  • TLSH
    T11D231A003BE8812BF2BE4F78ADF25145867AF1632603D95A1CC451DB5723BC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2