Extracted

• • Target
    5a433186d4ec2d2df1bfcdca4ca7986b90f3f0cff740207a37d6b8140788419b
  • Size 45KB
  • SHA256 5a433186d4ec2d2df1bfcdca4ca7986b90f3f0cff740207a37d6b8140788419b
  • MD5 b9a627e7c8ed171c18303539c80369e8
  • SHA1 9f14451f10d87d66c0a624d36c9e4b4761c4a113
  • SHA512 e3ff59cec8f003b26305ca0d3f745379ae1edfe84e0df97f822ae7efc1014e82d14b7d1031b58156bbbba6d4af13510b62de1f4a8f645e9066a4f451bcee1b70
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFD3xY6yZoOPI5zjbHgW3idhSSH4TA6BDZUx:cu7e5TH2A22uPo353bAWS+C0AkdUx
  • TLSH
    T1B6232A003BE8822BF2BE4F7899F25245867AF5A33503D5492CC452DB4713FC69A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2