Extracted

• • Target
    ce5080ea05ab38fbc3b3e79843e23555dd9e7fe9b1df6675b4e3dc04c58165d0
  • Size 45KB
  • SHA256 ce5080ea05ab38fbc3b3e79843e23555dd9e7fe9b1df6675b4e3dc04c58165d0
  • MD5 299691a80cb4b381f4b7d8a599f1fdc1
  • SHA1 3dfeeb4f4e9b8a924e751391d07c345c8f7fa394
  • SHA512 57ad10c5faea55b98e5dd1c87fbbb38dab995aec0928cdb56835fb0db744d573bc6331b9e90803a3b7b6bd260c927722be9fcfd2264894be44e097d4909f2e28
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNrITnyfaaPI0zjbRgX3iiDukbANLFdKGdBDZ0x:5uSy6pTpoo2oEh03beXSiDukcz4Wd0x
  • TLSH
    T1C2232B003BE9C12BF2BE5F789DF26105467AF6632A03D5891CC411DB5713BC68A52AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2