Extracted

• • Target
    5f9508ac106d684b69783b02983e55b445dd908909000fb352ca35aaa886bcdf
  • Size 45KB
  • SHA256 5f9508ac106d684b69783b02983e55b445dd908909000fb352ca35aaa886bcdf
  • MD5 5c4f6943a19d2aaeec4dc6d082bfe8d9
  • SHA1 9e3c0c905b4e92901725a1f10f176efcfaa95a49
  • SHA512 74af37d28ccd16c2f4ecc6008d3ff154d8dfb37cd065c33e8ffccbc5947faaf05bce36af712f83f390e8995b0cf44e8a943da342de405b1324c9c6ebd0c200ac
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwkSAFcKoabbb4ZhM/RPIAEzjb9gX3iWt+pmWudrd+w:ku40ZTXEb2oSAvQZh6OAE3bqXSWtFJw
  • TLSH
    T196231A003BE8C12BF2BF4F7899F262458A7AF2632603D58A1CC451975713BC6DA526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2