Extracted

• • Target
    5b53ebcfea078b91d153079e39cceb4c5e633e7012db95ea0068ce50870bac6b
  • Size 45KB
  • SHA256 5b53ebcfea078b91d153079e39cceb4c5e633e7012db95ea0068ce50870bac6b
  • MD5 67ea93a6f8aaa29551eda2be8ab5cd70
  • SHA1 a84be8b449fc72740df3aa20d3cb1485c06c925e
  • SHA512 1d916addd3c20c209dab4848d8afcb0a7f04df8eb2ca1ce33f02b1f8c6734aeb7c840e81fd92c3850ba8ab861908da13c2509ab59e282ce81bb2b2de1c3f7081
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFMSAFcKoabbb4ZhM/RPIAEzjbggX3iPUuA1FV8EIioU:MuLAZTnbg2vSAvQZh6OAE3bHXSPAfOEr
  • TLSH
    T104231B003BE8C12BF2BF4F78A9F261458A7AF1633603D55A1CC4529B5713FC59A42AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2