Extracted

• • Target
    f5438882f1059c4ae1094d69225b92232768e03c8e6436d7e08a805978cfd0a3
  • Size 45KB
  • SHA256 f5438882f1059c4ae1094d69225b92232768e03c8e6436d7e08a805978cfd0a3
  • MD5 861e204503c37e7dcddb3dab0ac5717b
  • SHA1 c03f7d65dfb8af06f83138ef17554b93bb39aba4
  • SHA512 62636b47ad80301a37bb99aa7aa7df55a12205cef6ab2c49646df747d4a48780f65cad9b14d45645c6f46206eeb95ac47434cd508d42684091d935de12031edc
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9BSEMTFab4OPIM1zjbSgX3m3EMBNQ8e5TTr2HSBDZ+:0u1YJTHcw2O2QE3M13bVX23EeU5r2Md+
  • TLSH
    T1B8231A003BE9822BF27E5F7898F26145867AF6633602E54D1CC441DB5613FC6DA42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2