Extracted

• • Target
    54dbf5c2a5e56c71aa7f65d1bf8c792d5117e35b7bd8bb983e5dc8febb472266
  • Size 45KB
  • SHA256 54dbf5c2a5e56c71aa7f65d1bf8c792d5117e35b7bd8bb983e5dc8febb472266
  • MD5 eebbffccf4a132fd481de9961934c85f
  • SHA1 7562424aee86fc032536fa5f72a124485c7750be
  • SHA512 34564fbe67364e8f7f6a85da2b0f745bef23105ead4a768bc6c8a08d84838ef9853cb24440f46d7906ace61f90c39b5f1baad23dace40df6b991b97e5543c8f9
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAAqJaxjwHuPI7zjbQgX3iFL8zmlebCZ8ItEXBDZcx:UuKWgSJTwRf2Q3+373bXXSRsGZgRdcx
  • TLSH
    T107232B103BE8C22BF2BE4FB499F26145467AF6633603D64D2CC451DB5623BC686426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2