Extracted

• • Target
    5bec61dbff646b1612ec374cadf78590bb50f1a1e0fb762f99c4db76c76a2b6f
  • Size 45KB
  • SHA256 5bec61dbff646b1612ec374cadf78590bb50f1a1e0fb762f99c4db76c76a2b6f
  • MD5 f2f93b3b2957bc0bc724eff94665e8b5
  • SHA1 d102b4b74c73f727b0ced0c2bcfc7fc239164660
  • SHA512 d5bdb558d7a95ab9eadd475341d9b4aae9177a17bafe605acd9b5d7ab702b0d5d16d829a3de0736569da22046ab976408015ccab7415065bc74bcb74c302a19d
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1n+GtCV+JtHuPImzjbygX3ijhknz/BDZUx:cu6YepTPso2M+TM3m3b1XSFsJdUx
  • TLSH
    T15C232B103BE8812BF2BE4FB498F26146467EF6632603D68D2CC451DB5613FC696426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2