Extracted

• • Target
    5462c69cd9e5f18dac6ea97fbcd43e9f704bc1f98ba118f4fa8114b01aa9abe5
  • Size 45KB
  • SHA256 5462c69cd9e5f18dac6ea97fbcd43e9f704bc1f98ba118f4fa8114b01aa9abe5
  • MD5 86f3e2dc5613b03c30b0de2fa5a6a680
  • SHA1 bcb64203a7406d5d3ed89494c0dbd3619ecb992e
  • SHA512 9de09f5a1e29de243ee627075316c6f056b94777288e676fc9a14180d5197c4b32d5617d4da95ad67adea14abb20779d15291332f7ed131ce1ba2ec66f1de725
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVE10CnMQRPn98PIQbjbggX3iRcc2Sac9snBDZEx:MuBGJTPho2dtnbvBQPbHXSR39pIdEx
  • TLSH
    T183232B0037E9812BF2BE4F7459F26145867AF6633A03D64A1CC451DB5B23FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2