Extracted

• • Target
    5447fc6b134e1353bfa99db14ecb1e041baae8b936d4e11f07ac7fadf905e805
  • Size 45KB
  • SHA256 5447fc6b134e1353bfa99db14ecb1e041baae8b936d4e11f07ac7fadf905e805
  • MD5 78b49f24684da88ae22ab0c4562b2b8f
  • SHA1 aadc3003963af48620e30acf4612b5fb983a0cd6
  • SHA512 eaf430b169b06dfd4bb6d6ed473a9411b892513c7c3c62b8de76343d1f65e4c3e0188f893dc3a81c709dc3dcc23e18c661f1300a09caf982c415a62012aa26a3
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1suwZQaKkPI6zjb0gX3iBqFXNv+PmCwiDBDZUx:cu6YepTPso2/I63bbXSBqFX0uCwiFdUx
  • TLSH
    T153232B0037E8812BF2BE5BB8ACF26145867AF5633603D54D2CC451DB5B23FC69A426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2