Extracted

• • Target
    5431d54ac5e0f708cf2fd24a80ea464fbcdff0460b10022f6631c8367bcf33a1
  • Size 45KB
  • SHA256 5431d54ac5e0f708cf2fd24a80ea464fbcdff0460b10022f6631c8367bcf33a1
  • MD5 56d0c482225fd932046862f486eee709
  • SHA1 1ef83d8a4a3c5258e8ee3c1e1ac691e527856b1c
  • SHA512 ac868e8d03ed7f2c55914c03559a789d067238454b4f59a6f59ea902a0b80418f675296b262f5c07048c5ce766c3aed6ee748eac133f6a9a0e16212e2d5fa30d
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVeBzCQKx7PIm1jbCgX3ijjzz1vA5sSXonCCMipkBDZm:suJdpTPdI2/o0mdblXS7z14PJdkx
  • TLSH
    T19E232B003BD9812BF2BE4BB8ACF26145867AF6636603D54D2CC451D75723FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2