Extracted

• • Target
    5873d398a0807f4882e09389c7792e14a5ad037d2c61265b2340a695265b5334
  • Size 45KB
  • SHA256 5873d398a0807f4882e09389c7792e14a5ad037d2c61265b2340a695265b5334
  • MD5 7e0884190ec5ec3048717dbfb2a68055
  • SHA1 96dbb8182b0cf0e0984d910036d26f500ab79a30
  • SHA512 c79214533dab15318d9207990450cfaa30cb650863e579ec2bc11da817ef8abcd00273f05ee243affbf2ff69a3a98fed1e10cc89261314a6267579fc18e3335d
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q90ZbtDMQPI8bjbIgX3iDWlGnh+/X2fxDBDZsx:EulCJTHl42lJk8PbfXSDWl++/X2JFdsx
  • TLSH
    T1CD231A003BE8C12BF2BE4F7499F26145867AF6633A03D58D1CC4119B5623FC59A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2