Extracted

• • Target
    5b541df8802a4688b60f0d553e17e1d42aa9c93be4843c2ba2371c688f316b79
  • Size 45KB
  • SHA256 5b541df8802a4688b60f0d553e17e1d42aa9c93be4843c2ba2371c688f316b79
  • MD5 c366c975f420e9b066c5eb81c53e5741
  • SHA1 2f6edc5f520b0f3af4f4c4a09f5b25144b52d62a
  • SHA512 21622b9ba64a8ce7d47427098182e4984f361eedf0a21300252989beff09551702374ad3e8f15c3f602e66818e7d5d3877c370ceb3895f333c950cba61996508
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwnZTohEaSPI4zjb/gX3iw+jKrOUI4Pv/BDZMx:ku40ZTXEb2d4Ea743bIXSw7r5XvJdMx
  • TLSH
    T18A230A003BE8812BF2BE4F789CF26145867AB6637603D54D2CC4519B5613FC6DA42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2