Extracted

• • Target
    531e78b354c4c3bc34c6756cb7fa4455c4cca99f05ebc87cb24e42c071777f56
  • Size 45KB
  • SHA256 531e78b354c4c3bc34c6756cb7fa4455c4cca99f05ebc87cb24e42c071777f56
  • MD5 a5073187e4cbba6724ca47e5be1a2cae
  • SHA1 54e6b4bcb13c4a9f1dfd82e48e1683ad30169db2
  • SHA512 f6360efe7369bb30a6c968579956635e3699ba7d8af3d2ba18b9565e7c23613b3ea2afefec02c4a75d0b7c1aab5e6fea419a4bc297fbb7335e5b16b0d34dc155
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9EELO9YjMHPICUzjbhgX3ipj9jR2nd3dFxu/hUUBD4:0u1YJTHcw2F6wgCU3bOXSpj9jcnd3dFt
  • TLSH
    T13F231B003BE9C23BF2BE4F78A9F26145867AF6632603D54D1CC451DB5623FC68A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2