Extracted

• • Target
    b5db740479a8f5cb4e4e6ec1c62aa233c712144fe34b4d59ef60db2a1f468555
  • Size 45KB
  • SHA256 b5db740479a8f5cb4e4e6ec1c62aa233c712144fe34b4d59ef60db2a1f468555
  • MD5 20550b66e695b34a74b6dc29643df039
  • SHA1 bb32327e6a0462debfd17dc43d02633aa7c63d89
  • SHA512 f5d9a17e29fac3d5849ca704c7cc8f6b940995064d3128d70c345a65dadfc0e423543728187f99f23fce46d20f452389dac5306688603a1c43628c2627e97363
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlcNd3u40cMOPI04zjbjgXhyiX2I5uL7bheEOBDZO:wuDWZTpMZSB2r8+M3043b8XF/unMldMx
  • TLSH
    T1F2232C003BE8C12BF1BE4F7898F26245867AF2677603D64A1CC451DB4713BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2