Extracted

• • Target
    5d1cf9808053afd3d6fc4f6ba40bc0bc408be96d3b9d41c9ab6f360a0fb7e548
  • Size 45KB
  • SHA256 5d1cf9808053afd3d6fc4f6ba40bc0bc408be96d3b9d41c9ab6f360a0fb7e548
  • MD5 911695323fd44b768a5b5e7993eade0d
  • SHA1 746c9f2a1f9b86f2ff4aa888f75b9dd7337001c4
  • SHA512 41552bc78dfb132281cbdf8071ed15d44c398d3e94eab1b2900bb476358b93c1c65516f1844fff1a3159eaba0b70e4d1f01f03e6664d5db1ef528586dc03925f
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q98ITnyHaaPI9zjbvgX3i939N9bi7pz4x3nItg1RBDI:EufspTf2g23E593bYXS9lbi56IIdsx
  • TLSH
    T1C5231A003BE9C12BF2BE4F789DF26145467AF6632603D68E1CC4119B5713FC69A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2