Extracted

• • Target
    5a38b7775860df49591a49e94fa54cbd8eb52a7e95b29acb9a7fe64552eea5e1
  • Size 45KB
  • SHA256 5a38b7775860df49591a49e94fa54cbd8eb52a7e95b29acb9a7fe64552eea5e1
  • MD5 3138b865a0e8acb57c935699a1769f27
  • SHA1 cfbd808fa0fb080203055a428f2156f14b7066a6
  • SHA512 93f907b625683f7961e721128ddb7dbb4542d0677056dcbd99e8d9cb2f131cb933050bc850777757d19920725839912112a6e1c477b687272e8dbb81fa859263
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwP3FoDEaOPI+zjbOgX3iilXAjkIoWBDZMx:ku40ZTXEb25KEa3+3bxXSwXZ14dMx
  • TLSH
    T182231A003BE8822BF2BE4F78ADF26145857EF5632603D5491CC451DB5613BC6D642AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2