Extracted

• • Target
    5285317268d32f84847e98a7e952edf7aec5c5f70de0eb913a350bfe379f69b2
  • Size 45KB
  • SHA256 5285317268d32f84847e98a7e952edf7aec5c5f70de0eb913a350bfe379f69b2
  • MD5 a44fce807a8384bb35bfdef7c9c490f8
  • SHA1 2235d3c0c9d34bf3d3ae73f9e73c211fd050469f
  • SHA512 ab23442748ff78f2e078bccbb9cf0336c7b62eba0d18eb77bc0ffc2e7fa289b511050e083f767147623520f2557a15633ee76a7c0854c2024679b33c72ced0c3
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFP9xY6aZOOPIrzjb/g83iMQPv5bmjHBFWpBDZUx:cu7e5TH2A26s/O3r3bI8SMQn0jS3dUx
  • TLSH
    T1B9232B003BE88127F2BE5F7899F26145867AF6633603D64E1CC451DB4A13FC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2