Extracted

• • Target
    5e593151bc05eb78fbffc79a5565ff78fe0b59bdcdfe828573f869e3bf1dd3c2
  • Size 45KB
  • SHA256 5e593151bc05eb78fbffc79a5565ff78fe0b59bdcdfe828573f869e3bf1dd3c2
  • MD5 c9cb7a32c058d1d448e01eff512f53ab
  • SHA1 cb7c9b2790c1bc71eda08d5ca2b1dacf8f5ad740
  • SHA512 6486c5c5e28618b94bdac0764bcb38e525177d7f8f16ce411bfbf4fa275f82058412688ab0f67ad28350073c728d6971729d2d21933a82fe71defbf48555040c
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1WT9Qpm9PIZzjbngX3iNiSPdcTvBDZcx:RuxkJTgip2BQZ3bgXSMSVqdcx
  • TLSH
    T106232B003BED8237F2BE4FB898F26145467AF2632603D5496CC451DB5623FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2