Extracted

• • Target
    5bb3f3333e03a9b1348a1d4d69cb9dcf6a23b0b80aae66bae8c6c407b6ceebb5
  • Size 45KB
  • SHA256 5bb3f3333e03a9b1348a1d4d69cb9dcf6a23b0b80aae66bae8c6c407b6ceebb5
  • MD5 5d968df80d274f49b7746cd61fe7946e
  • SHA1 c992ea62703bb0bcbde955084f56aac8183a3ee5
  • SHA512 7b83fae79f3cb45f5948079c37ad415ea439494a75bceb7aa7a329625949cc35c3a4237ecbd6166140b1ad090a96b704f9c64c24bfb30227f8c99d77891ab3b2
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q98ITnyfaaPI0zjblgX3iKalFyXFt4vTA6LcxFjBDZu:EufspTf2g23Eh03biXS3lAV+rl4rldsx
  • TLSH
    T124232B003BE9C13BF2BE5F7899F26146867AF6632603D64D1CC4119B5713BC6CA426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2