Extracted

• • Target
    c5c2c816b084b557598951aac2e80938e32afcc6959ab0aeab8e427484c99f9e
  • Size 45KB
  • SHA256 c5c2c816b084b557598951aac2e80938e32afcc6959ab0aeab8e427484c99f9e
  • MD5 9470980ddea7ee3fbeba045e96c9ad04
  • SHA1 1c9f364170c3baf9c3b0a6f2ff83e77d0d1886ef
  • SHA512 ff6cb146c2955f3966dda92e22adc6bb6ac4ef6f8f04ac78bcdb12a64002afc8b752ae6b2ff49bcfb8bb292a1aaeb9b79326811f9c695a936e9ee304fece8070
  • SSDEEP 768:rukO5TkI7ZzWUTZ9Fmo2qTQ4UdA8Mal58FnPIMHzjbbgX3nwDoG9kFkQ2DUmBDZ2:rukO5TkUH2kUp7l5wAMH3bkX3wUG2Fk2
  • TLSH
    T1D8232B007BE8C12BF2BE4F7899F26145867AF2633603D58A1CC4519B4713FC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2