Extracted

• • Target
    513dd5d8ee21d1ad4b8064dfe64f54946c906beb6f0193dd758d993aa637552a
  • Size 45KB
  • SHA256 513dd5d8ee21d1ad4b8064dfe64f54946c906beb6f0193dd758d993aa637552a
  • MD5 35502aa1b8625ab1de9c5fefebf64088
  • SHA1 c1c2393df1f54a21e64a6cdb5871fdc00f36d7bb
  • SHA512 76fb90206a1bfc2d5c7843da5ae5407c8eba0772ea2737190b2ea9ab5fcbad7a3605010f5e51db004cecb540e45a487a67f3686194311adbc3601b13674a6701
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFB3XodEayPIVzjbagX3i+pYKr+/rXBDZEx:MuLAZTnbg2uUEabV3bNXS+p+jRdEx
  • TLSH
    T1E3231A003BE8812BF2BE4FB89CF26145867AF5736603D6491CC445DB5723FC696426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2