Extracted

• • Target
    5fd5326b99afe44fb96c06a428cd019b2e93d74b8b1254fc51affb4fe056ef9d
  • Size 45KB
  • SHA256 5fd5326b99afe44fb96c06a428cd019b2e93d74b8b1254fc51affb4fe056ef9d
  • MD5 622139c6dffc3e45e33adb00a50fb692
  • SHA1 3840f873b56e47574584d79e693ad4ad3fbda52f
  • SHA512 894159d398ee7a09019647a158d077fccfe8cef8a991fca5186ee266c89ee678b5c91c03c5e215b9ccd0347dbd6e797d76c3f22653f95405afd8dae0a6d3cc11
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qV/FpPklON8APIDzjbrgX3i5327Jds4nlqOYwChBDZkx:suJdpTPdI227kwN8lD3bUXSAdzlfwdkx
  • TLSH
    T1492319003BE8813BF27E4B7899F26145467AF6637603D68A1CC452DB5623FC29B426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2