Extracted

• • Target
    bed5a981a1043a2e62d6c201d6c64fb3550f519884deda6a722c5444f19995a8
  • Size 45KB
  • SHA256 bed5a981a1043a2e62d6c201d6c64fb3550f519884deda6a722c5444f19995a8
  • MD5 7d262999b4eae7f8f3f19c7ceda43b1d
  • SHA1 d91d3c224f26de8b99a155a3bbb14125f4fd4ca8
  • SHA512 ec21f875ec70cbc62dc045f63483adb6cc828a0d86d858e90def9d1faac11f68c9cc4e14c384d0bd75ffe6901a937b81493c2ba9c09e2439ffd4cd420854aed3
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtjZbtDMQPI8fjbEgX3iuR6HKCtg5tGaBDZ0x:5udApTNmU2sJk8rbLXSb+EEd0x
  • TLSH
    T1D6231B0037E8822BF2BE5F78A8F25145867AF1673603D5892CC451DB5623FC69A427FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2