Extracted

• • Target
    5c9b64aada8c6f6aedfede434720511d2dc5cdaef1535b577c96df002b995d7d
  • Size 45KB
  • SHA256 5c9b64aada8c6f6aedfede434720511d2dc5cdaef1535b577c96df002b995d7d
  • MD5 240e99430830575ce1109517e40dd630
  • SHA1 ed1c9ba08d5817e6e9734b2aade00ccfc7df2667
  • SHA512 bdc561859e9bf8eadc1c9dd7bd7bc6df53c36c96cb4384e6e50ca25ae7157e1557fa8e64c9d09284c45e671eed553093b568dc1a7a2f70ad9fe3c0a8c0cf53b0
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAhpt0CCM+d4CvS8PIk6jbNgX3iEKLUc509yV2gl7eB8:kuSOpTPOP2x/CFWBkWbaXSEKLUceyV2O
  • TLSH
    T10F231B003BE9812BF2BE8B7868F26145867AF6732503D54E1CC451DB5723BC69643AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2