Extracted

• • Target
    5880da77e3ccc054d7285c8438de85e07e475a55b7904119a8a42903a5b84ddd
  • Size 45KB
  • SHA256 5880da77e3ccc054d7285c8438de85e07e475a55b7904119a8a42903a5b84ddd
  • MD5 140b77f0963fe28ecaee7e7f10b304c0
  • SHA1 936547f84e6f68a273c827c46e980292fbdfc3e0
  • SHA512 b3ac503df9f9cf351cb60da3be75df42584b4e33215fce513169fad4656a15c258bfea8a2cddfcef1ebbce64f45e330bd7d80814ac117cc4a097face9686c2cd
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFY3vO4iZMOPI0/zjbpgC3iImHTr/NATCHBDZEx:MuLAZTnbg2RmNM30/3bmCSRZAmhdEx
  • TLSH
    T1EA232C003BE8812BF2BE4F78ACF26145867AF2676603D54E1CC451DB5613FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2