Extracted

• • Target
    5e7c319ec25127bd56e75988bdd865d00b765eb34e5ef7dba34b8208448bd79b
  • Size 45KB
  • SHA256 5e7c319ec25127bd56e75988bdd865d00b765eb34e5ef7dba34b8208448bd79b
  • MD5 b02134fb10f96a22005807442008d5ed
  • SHA1 e89799d7f95ffe740eafacaf37f16439ef285dc1
  • SHA512 55af725e3555929b8fab45a67c5015bc6609c432803572354c5e1f7a6b86c979f42113b5ac9868d795433f2cdfd6132bf63d5582b7db54716a1e4754daa42c18
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwXJXo5EayPIRzjbjgX3ibi1QePDcktzBDZMx:ku40ZTXEb2JQEabR3b8XS217PDckTdMx
  • TLSH
    T1A7231A003BE8826BF2BE4F789DF26145867AF2637603D5492CC441DB5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2