Extracted

• • Target
    5fbdb33fc99705975e0b2fa5e5706c7976e85ed1c2fb44d359a96217a2611799
  • Size 45KB
  • SHA256 5fbdb33fc99705975e0b2fa5e5706c7976e85ed1c2fb44d359a96217a2611799
  • MD5 915e55b63710c730f773100f0ef2bb6a
  • SHA1 9f783764009e22039c72f2343e0f8bece19886c5
  • SHA512 38f9e1fe2cbf99d06492c5f47c8fd2b5cc8f3b55879bbb15acee2c3f78970b45b74ea8b5e8bd7ba0370b252b19ed954ffba921a0bc4956dd6fdcc7267aebfeac
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNvozHyvCKPIiKjbPgX3iyIc2cn9T40UGAeBDZ0x:5uSy6pTpoo2xL5iGb4XSyfBDtAwd0x
  • TLSH
    T1D1232A003BE9C227F2BE5F789DF26105867AF6633A03D6491CC4119B5713BC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2