Extracted

• • Target
    b5481fe9ddde98064248955c0548d13c79c352fa68999ab70d94e35e127251db
  • Size 45KB
  • SHA256 b5481fe9ddde98064248955c0548d13c79c352fa68999ab70d94e35e127251db
  • MD5 7c41e0e52c338afbb03f94e2d9014d69
  • SHA1 8909a2f06c26f060b61c252481ae328aba707251
  • SHA512 b301e4b0260054dd67f45a94fee48af495333e989b0c5f558a0563d4ee2de27ec6e348165969c585b30e9aeeb9b4cbf86b8cb5666e38c2b7cd25160797e77a8a
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4Mwz/y3qiPIQzjbxgX3i0qDPDCz1Sq57sBDZ0x:8uUIpT4vAj240hQ3b+XS9CLqd0x
  • TLSH
    T1CE233B0037E9C12BF2BE5F78ADF26145867AB6633603D58D1CC4119B1723BC59A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2