Extracted

• • Target
    ac53e6697b869a816ffb65d8944c496f0bff8b23ceb759efae31a6867e3c46a5
  • Size 45KB
  • SHA256 ac53e6697b869a816ffb65d8944c496f0bff8b23ceb759efae31a6867e3c46a5
  • MD5 b2fc2ad1a41f873d4a807feca210d41a
  • SHA1 9446f679908134c4e073c453fb1e113c53d8245c
  • SHA512 066b7c77846b0ccb5646da94182475a02ede98c9cd31427f3a9fb0041b24a98fbd434d5f95a7ee9e122d2c9e8ef5198300e8564bc8607609a1d0f23ca0f07d27
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAvT2Qpm7PIhTjb+gX3iub21sLf/muVPKT4WOBDZcx:UuKWgSJTwRf2qehXbBXSuC1yfTPtWAde
  • TLSH
    T16C231A003BE9813BF2BE4FB898F26145867AF5637603D6496CC411DB5623FC29A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2