Extracted

• • Target
    5ab4efc650c98c4e12c0dac56538d2762ff726305781b2bdbd9aeaea4779e759
  • Size 45KB
  • SHA256 5ab4efc650c98c4e12c0dac56538d2762ff726305781b2bdbd9aeaea4779e759
  • MD5 1588299375b50c5a1cf789ca4b430096
  • SHA1 3494113f7291898081795121cdba1616091425cf
  • SHA512 602d668d985db7e6aad131a2e0fb87ca11762d185bf57482018770b250020ec0c6d40727263fc2aa164b8aa46f5bd2ce2b50f18f43b98ef5764c20e47a77f781
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4gozHyvCKPIiQjbJgX3iREZKH19tR7AYUBDZ0x:8uUIpT4vAj25L5iYbGXSRE419tR7AYiU
  • TLSH
    T1A2233B103BE9C12BF2BE4F749DF26145867AF6733A03D6891CC4119B1613BC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2