Extracted

• • Target
    00f5e28ddc7d16a105451ffdea4e3a5f11c24f53df9713c6f7730e2f53257b94
  • Size 45KB
  • SHA256 00f5e28ddc7d16a105451ffdea4e3a5f11c24f53df9713c6f7730e2f53257b94
  • MD5 22ccd31c623ca195ae5ec1662263520c
  • SHA1 11688f4e9fb4020e2d32106a1fd76520cbeca89f
  • SHA512 01f5080ed152be1a82dcd341f9d7e539e14b44f2d2136656e8e86a176ef918e499866b750d339d15e4e04d30b01087ce074de306151974adbf027fba808232b4
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAW0ewtDc30oiZPI/zjbwgX3ibS/q9XyPco7Iz7yxlB8:kuSOpTPOP24wR2iW/3b3XSbS/q1yEokV
  • TLSH
    T19F233A003BE9812BF2BE5F74A8F26145867AF6732603D5491CC451DB4623FC69A43AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2