Extracted

• • Target
    597e6f5a9d943e518dcde9e6322f385400e04a2549c2684ffda5fc789f561c98
  • Size 45KB
  • SHA256 597e6f5a9d943e518dcde9e6322f385400e04a2549c2684ffda5fc789f561c98
  • MD5 e32b5b095d25212712320e77db41df94
  • SHA1 09afd1a26fda7f520b7b02b0e4b24369ff01f456
  • SHA512 6d8473c170d75ef099bbd74d80ddb89024b817edd5b6700d677474385d7a8e5e98a8235e9fd4f373e8a832230ab61aad011f776078d1d8df6ea7dc496d4e03b9
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9tCSwTMSPI5Wjb/gX3ic8Wa7vwsulTLWZBDZsx:EulCJTHl42agG5abIXSc8mcdsx
  • TLSH
    T16D232B003BE8C12BF2BE4F78ADF26145867AF6676603D58D1CC4419B5623FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2