Extracted

• • Target
    59b7d5bef88e193888b83afb52da01ac8c78dc15101ace6cc8384115cce1c634
  • Size 45KB
  • SHA256 59b7d5bef88e193888b83afb52da01ac8c78dc15101ace6cc8384115cce1c634
  • MD5 f8c1751f65dc6b9d175d51a39ade94ff
  • SHA1 e569fbb40620783698ab654d4734feb460e439f3
  • SHA512 7a542b51d9c6be10e8c2df7257463192a5b127b69515ade0cedb04ffbb6d31d7771bed40e6586009171f7c68e2f6dcd9b212c7c0a0be730736d89837b59a9b69
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9L9Y6kq/zNOPI+zjbZgy3iNmYfFmxBpumABDZsx:EufspTf2g2ma9C3+3b2ySN1FmxBwmWdu
  • TLSH
    T1B52339003BE8C12BF2BE5F789DF26145867AB6633603D64A1CC411975723FC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2