Extracted

• • Target
    5ff5e8dbc0de16f8c688533f7de0d4224be0f7124927dadc53932aaaf03fbc37
  • Size 45KB
  • SHA256 5ff5e8dbc0de16f8c688533f7de0d4224be0f7124927dadc53932aaaf03fbc37
  • MD5 58739047980561634f53e8a434193fcc
  • SHA1 75c631b61224c47724d33c71d22c03be89ff01fd
  • SHA512 5c3284ef171e1a9805cf96cae2d4da77a84ccf8b85ca868df17439177890ea59c7ba9afad0b0372c4346bc34d89ec62c82a340dbe5f686d8f9a48d430699dfaf
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlKzdAAyPMlL8TfPIMWzjbYgX3Oe3LDba/DT1z0B8:wuDWZTpMZSB2/lvlL+4MW3bPX+kDbelh
  • TLSH
    T1E4232A003BE9812BF2BF4F7899F26145867AF2733603D58A1CC452D75623FC68A529ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2