Extracted

• • Target
    da5dc05fb6aa96214d7d243b768fda106c6d3945e9f46b286f3789953f81d488
  • Size 45KB
  • SHA256 da5dc05fb6aa96214d7d243b768fda106c6d3945e9f46b286f3789953f81d488
  • MD5 e7d5acbbd99a693dc3947e24a0a0457e
  • SHA1 afe26760b4fbc5f3638de41856b9f1927087b271
  • SHA512 38695399442862d90990c3174c91d6d25a78f538d02cd1e12da0ac7350e968ba4342047b7a0dfa72779d0842d056ca30aa344c2ba864428bbb38a4986d3dda52
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAp0e3NEAKViZPIazjbEgh3itjnltDxwXwWU7KkBDZMx:kuSOpTPOP2t3exiWa3bLhSDPwX5UldMx
  • TLSH
    T191231B0037E9C12BF2BE4F78A8F26145867AF6632603E54A1CC451D75613FC69A436FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2