Extracted

• • Target
    5a7ebc264179116d4d527226d10e30998c4e41aaf14f2074b9c0f238ed64933f
  • Size 45KB
  • SHA256 5a7ebc264179116d4d527226d10e30998c4e41aaf14f2074b9c0f238ed64933f
  • MD5 dd4fe788b568ebd4d140577b24ccd626
  • SHA1 5fb0760f5e18f7ed3481e5f47e3149a85078b089
  • SHA512 2e70809c968088b0f829041fbd68d06ec17a15e386d726268da4482eb41aa12fbef46bd4d0a9e7a6c75a6f5ff530c8e65f16d50bb8a12e57c0ed91a7e9da9d33
  • SSDEEP 768:QuflpT8AkKuWUch7wmo2q96qz8yfzuOPI9zjblgXai47Hgpe6RVLCctuj5BDZTx:QuflpT8Hv2XqQJ393biXjmHgQ6RZCdjH
  • TLSH
    T19E233B003BE9812BF2BE4F7499F26145867AF2673603D64A1CC4529B4713FC5CA52AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2