Extracted

• • Target
    a5c68a8248d12621b2f9dc0a3683ff3c681ec13862f1b31158c2510c8603ff22
  • Size 45KB
  • SHA256 a5c68a8248d12621b2f9dc0a3683ff3c681ec13862f1b31158c2510c8603ff22
  • MD5 0f873ee8e39b99d2c2273db51a49d985
  • SHA1 952fda2416a2dac166d664a0d8ee35b1b922eaa0
  • SHA512 15bd4b81e31195b6633a0ab6b4cbc4e2db2c35de7d8bc4882aee1ef63d3625f86f826639e3aa3304d65ca94d005ae4734b49fa1f4461e0f1b81d9f70ecc27b04
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNrzjHy/aKPIbrjbMgX3iUUnxl7Pg5YSLhBmtzLBD:5uSy6pTpoo2onhb/bDXSdxJYymhBed0x
  • TLSH
    T107232A003BE9822BF2BE5F78ADF26105857AF5633A03D64D1CC411975713BC68A52AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2