Extracted

• • Target
    c5d532a6352187bd1b7a73be2ffef785879514a5c4d926e0c5e438725d5a52f8
  • Size 45KB
  • SHA256 c5d532a6352187bd1b7a73be2ffef785879514a5c4d926e0c5e438725d5a52f8
  • MD5 1c13db48ce3ce04db2e3cb20abbab5f3
  • SHA1 aeba10038d268e4b95dc09670aa359961253e194
  • SHA512 8d291587ff9278062cba891f2a7604c3c10dbe05ec18ada9faf2d47e4ced4cd54ae9368d34414eaa6d377cad8e92111d6d09dc7f2c12e6101b21322d6b3127eb
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q11Bz3QKx7PIQpjbSgX3iXDWMKhBDZcx:RuxkJTgip2AV0QJbVXSXaDdcx
  • TLSH
    T132231A003BE9813BF2BE4BB4ACF26145467AF1737603D54E2CC452DB5623BC69A426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2