Extracted

• • Target
    5cb83de0d4d7d7bfc04dddb2ce88bedb50638b030e4323303b7ff41e2832b94b
  • Size 45KB
  • SHA256 5cb83de0d4d7d7bfc04dddb2ce88bedb50638b030e4323303b7ff41e2832b94b
  • MD5 b8817cdb2c7bc95040216c5b82e868dc
  • SHA1 575c91f5891cbd7f785c73530556b6a507d0fe7e
  • SHA512 e4ce74e85f2ea98da8ea675df1fdba0a770706bd830283f4bc71d8dab03b6adb3ab78a1d22bcc50dda2a259ee45d951266119adc006a6cd82dfe5fe491e3db82
  • SSDEEP 768:4uBfJTMUyYUWUWBDimo2qV98V1yp7EcPIpzjblgX3i5To3qCyazgxw3U1OmYBDZV:4uBfJTMpv2O8V41Ehp3biXS5TS5rgEz/
  • TLSH
    T13B231B0037E9C22BF2BE4FB89DF26145867AF2672603D64A1CC451975623FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2