Extracted

• • Target
    58dc800fe7b8eebe30bb153a0ec4bb44682c70538da3cae27f59e732f6be22de
  • Size 45KB
  • SHA256 58dc800fe7b8eebe30bb153a0ec4bb44682c70538da3cae27f59e732f6be22de
  • MD5 cfeb21539dfc60f369f0f174eba68138
  • SHA1 c57fe10128295d5fe1e4f8f328db3da6fc41233d
  • SHA512 864de5857eed442e42e998b6e874ffd2e415204dc9a5aefca0994d1994b448731c04bae196801efa2290bf6f57347b1cacd68d9dcd3f9665adb1372aa4b470af
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFCm//GgrOPIm8zjbsgX3iuhDR724NYBDZUx:cu7e5TH2A2pmHb3Z3bjXSuhDRq4NedUx
  • TLSH
    T1472319003BEC822BF2BE4F7499F26145867AF6B36603D54A1CC451DB5613FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2