Extracted

• • Target
    5d96293a857362f9a9c199bc32324cf6fd910a779964387f0096e685b51511dd
  • Size 45KB
  • SHA256 5d96293a857362f9a9c199bc32324cf6fd910a779964387f0096e685b51511dd
  • MD5 6ff9e9f7ae99316fb6f783cf67278371
  • SHA1 79ba87574f7651fa4bafd895f5f8b6d1450df46d
  • SHA512 83ff7b41f51faebc75dfd267c65c39a7985ccdbe1531f5d9a7baabff964b06e03bbce656b0805c5d4c0f6cbb8fa90f0fc60694c7ef257b81e976ea667338b36c
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9AcQSCBznqNLPI7zjb0gX3ihUpMquWM6wjSEI2QI8O:EufspTf2g2Jc9UqC73bbXSGpMVWIzadu
  • TLSH
    T1D3231B003BE9812BF2BE4F7498F26145867AF6636603E54E2CC451DB5613FC6CA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2