Extracted

• • Target
    513d1b95e228ac8dd9b005719d419a3f54ba7cd4ab4de9f1c4dc88f63e4700dd
  • Size 45KB
  • SHA256 513d1b95e228ac8dd9b005719d419a3f54ba7cd4ab4de9f1c4dc88f63e4700dd
  • MD5 84fa7a70f35352fa140af8ac59848d0b
  • SHA1 10e40e79f5acd57fd8e329e0c113bdc3dd4e6805
  • SHA512 b4b0565e06d82cd8daaa20f051991fe0a2efc5b26ff2269a05290ab854c8cc7be70035ce045d8ae2a224b2db70b53837e22923eafa1272cc2cd8c5a66f0cb4b3
  • SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qAk0eUNEARViZPI6zjbCgp3ifIrfUKNXdEE7EysBDg:cuqNJTLr62GUe+iW63blpSfITNdEE0dW
  • TLSH
    T1AC230A0037E9812BF2BE4F78A9F26145867AF6633603D5491CC451DB5723FC68A436EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2