Extracted

• • Target
    b53c7e0859b5ec45f2756d77a0041a218a59ca67216ae1262e9271dee77b7f8d
  • Size 45KB
  • SHA256 b53c7e0859b5ec45f2756d77a0041a218a59ca67216ae1262e9271dee77b7f8d
  • MD5 9261e70bff4da4d92f2ddca770e88b8a
  • SHA1 bf4272c6f86a84f6c6c3cebc7e25ae1576a57440
  • SHA512 f6355921605580fa3d1f3fa67f32b8c1a1e540d3fca731e721c54aee60c538b5bfb74b3d1066692bbdecbe603fafc09c36fc0817792dd7f1b3dea0e558ad0476
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtqhkTHJNOPIchzjbZg23iNW2nVt8TAjBDZ0x:5udApTNmU2sLH3ch3b22Sg4td0x
  • TLSH
    T1DA232A003BE8822BF2BE4F7898F26145467AF6673603D58E1CC451D75613FC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2