Extracted

• • Target
    5b427157108f0d76ddfc32adcdd807d8b732da9cc42c2d5c7aee413bb9a6f61e
  • Size 45KB
  • SHA256 5b427157108f0d76ddfc32adcdd807d8b732da9cc42c2d5c7aee413bb9a6f61e
  • MD5 9c2571754ba07717e75a0fd7842d48c0
  • SHA1 579085891aff560b82e4cc58c45b3fd9d8c4ddd4
  • SHA512 5d871a553974fc6501e713677c509986c6dd7373cbf0d77458e9835cbe325408de134f0f2455f6d7f29b04356b75c8341cada00b5689b450ba79a6a4d289481b
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4T9YikqHztOPIUzjb+g93iuEplLK5GoKwp2BDZ0x:8uUIpT4vAj2XalK3U3bB9SuELu/ZYd0x
  • TLSH
    T117234B003BE9C12BF2BE5F7899F26145867AF6633603D64A1CC451DB1713BC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2