Extracted

• • Target
    58fdbff61da4b16da22cf4025af3acda56be5b742aa8f86dae780340c0b06923
  • Size 45KB
  • SHA256 58fdbff61da4b16da22cf4025af3acda56be5b742aa8f86dae780340c0b06923
  • MD5 0a04ae252fd79849190ee4f6644064a7
  • SHA1 82419e0064816cb26159505569be2a40c047cd8e
  • SHA512 adddf78fa8ce6398a954e79363e02778a1317b9f0eefae06cfa5c78457c67c1e20a83dc4a90bce2d30e9c4c4840496076e266984be477ee680ac7cf183f7f3ee
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q12xJdxCPHuPIXzjbbgS3imiQCrYLKS7TSi7LO3qBDY:RuxkJTgip2LZc3X3bkSSmUUWS7TSd30s
  • TLSH
    T1F4232B003BE8862BF2BE4F7498F26145867AF6633603D54D2CC452DB5623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2