Extracted

• • Target
    5c9c791e733ac0ef143ff73403f1e8cb4182f58d1fdb6c50b4c48acd150a756d
  • Size 45KB
  • SHA256 5c9c791e733ac0ef143ff73403f1e8cb4182f58d1fdb6c50b4c48acd150a756d
  • MD5 2d219c1b91326dbc6039bcbb0648429f
  • SHA1 f0d60521bf6852c416b0a4702ab7af5ab86f630a
  • SHA512 348a0e627430e513dd34a5f5107afa27f5f730d3a2dc34de4883f7e2c4c79ee1527f224953834a1b54214060d7ae5db62139a40559053a0a39ce0214688a3fa4
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVyLiE0XFjrdjYkk8PIiYjbdgX3iP1kpu4ZzzkBDZEx:MuBGJTPho2/L4XQBiQbKXSP1kpxzzSdG
  • TLSH
    T164231A0037E9C12BF2BE4F7869F26145867BF6732602D54A1CC451DB5A13FC68A43AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2