Extracted

• • Target
    05896bc4a4ae730c022c9565c6d54f1b50e46794eb15653de67e5c6efbbcec43
  • Size 45KB
  • SHA256 05896bc4a4ae730c022c9565c6d54f1b50e46794eb15653de67e5c6efbbcec43
  • MD5 b189430712d2942979d9bf3e7ac8bed3
  • SHA1 e6f220458246b8f5e974e5bf03afb93712d845b6
  • SHA512 8527c62d1df337499a079263a93b5e1a7e015bf7320b5b2e1b921bff95eb056941fa38503123842ed0b72537f7ed624f2c1f8339cfd10d7f6741ab0c15fd6312
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1P/qpG3jHuPIgzjbLgXOiLe6QdjitDxtHdBDZUx:cu6YepTPso2yIM3g3b0X3iVdjidzdUx
  • TLSH
    T1DD231A003BE8822BF2BE5F7868F26145867AF2637603D64D1CC451DB5713FC69A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2