Extracted

• • Target
    5f988bc29ec384403d63bf90e6c7936b5b7276440dda6596e717acbd3a710414
  • Size 45KB
  • SHA256 5f988bc29ec384403d63bf90e6c7936b5b7276440dda6596e717acbd3a710414
  • MD5 59d00c59b29af01baecfe67c37b953b6
  • SHA1 693707e925f518d030cd333cbd961c435c94e985
  • SHA512 60a4ff226404611fd2fc459d6856cab792d66122c1d138d1721b10a208f4e139ed700db178e4dbbe9197c16fa02704292d57059fac4c8042d5d49887582d53e2
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1zGsGx8OHuPI2zjb8gV3iQ39lmayVtcQBDZcx:RuxkJTgip2+ez323bTVSQNlVyVLdcx
  • TLSH
    T160232B0037E8822BF2BE4FB899F26145467AF6637603D5492CC452DB5623FC6C6426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2