Extracted

• • Target
    f5a56d5e4c7dbb23906f63ff53da0acb6e2a8538e1054a85eef7c4ae8c30b26a
  • Size 45KB
  • SHA256 f5a56d5e4c7dbb23906f63ff53da0acb6e2a8538e1054a85eef7c4ae8c30b26a
  • MD5 57f19d97851eb0225fd67b6b3f1143d6
  • SHA1 beab09fa45baf6b49cc055866e96dc2c57cf2ad2
  • SHA512 fb1568f63a61452d01b9093f05daa4784714bb65928e35459ca88d77da14f95c0c6dee860f1b604e5e18211ed42d9e2ccab3c2d513c59958033e00a5545e694d
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAhpt0CCM+d4CvS8PIkIjb/gX3i0SeeRNY34on0WosB8:kuSOpTPOP2x/CFWBkgbIXS0S3rY34LWw
  • TLSH
    T1FC231C0037E9812BF2BE4F78A9F26145867AF6633603D54A1C8451DB5723FC68A436FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2