Extracted

• • Target
    04c5f3e8282f1a5fa934f405d4c28cfcfb4e3fb9ef2d7832fdd17f75d812bf65
  • Size 45KB
  • SHA256 04c5f3e8282f1a5fa934f405d4c28cfcfb4e3fb9ef2d7832fdd17f75d812bf65
  • MD5 7cb070f7c2282007eb739a4bfafed793
  • SHA1 f706d184c23ea6941f27132b9f9958cbef111c12
  • SHA512 b6a2a86e52ef49659c6b7f9faa6441cc1d782f2c33c19115a6bb36685773b9b0d184879ad60a11144d34537f89bb7f254368be7c351d77788bcb946712f8bcc4
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4Mwz/y3qiPI7zjb6gX3iETOuD2dNBDZ0x:8uUIpT4vAj240h73btXSuQd0x
  • TLSH
    T179232B003BE9C12BF2BE4F789DF26145467AF6632A03D58D1CC4119B5723BC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2