Extracted

• • Target
    5b425c70c5c085387b8ec6b373745920337438c0d377f6a0932ba6b3099f6b7e
  • Size 45KB
  • SHA256 5b425c70c5c085387b8ec6b373745920337438c0d377f6a0932ba6b3099f6b7e
  • MD5 0977fe2020e1ae330e3aaaa29d3a382a
  • SHA1 3903e67f57b332d1af437c6a5ac51af524ffef94
  • SHA512 325398cc89b464623450572205c1861b355897b73004cdb6331711d8e39005e58c12d50d18ce1edda0962ecf8854b838c3ff20b02dccf74e4489684712fefd18
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFQeeXKSocbbbQtN8/nPI6kzjbbgX3i+Xj8SdscVL554:MuLAZTnbg2YeH2tNKA6k3bkXSGj892XE
  • TLSH
    T188231B003BE8C12BF2BE4F78A9F26145867AF6632603D58A1CC451DB5723FC696426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2