Extracted

• • Target
    5143c7367f217d36fb19ba65b62dfb7a053415e4f1aad94e19c6108972b017fb
  • Size 45KB
  • SHA256 5143c7367f217d36fb19ba65b62dfb7a053415e4f1aad94e19c6108972b017fb
  • MD5 7f698a7796f64ac9d881f63d5d44b727
  • SHA1 cc6d9a071498c91e23965a902ed36950795e1c6b
  • SHA512 5ddd2a60283f496f0f41cf9a976362fb925a08d24d04bfe9d1b761097fe120a48a7815a87c3923b4fcd62bbb84703ffeb7a67537d6154eaaf3105e12ee0dac85
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtiCXtTtoPIRzjbfgX3ioctJJiEvmtgML9C2KBDZ0x:5udApTNmU2Nw3R3boXSBNfa9rUd0x
  • TLSH
    T10E232B1037E8822BF2BE4F7899F26245857AF1673603D58E1CC441DB5623BC686527FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2