Extracted

• • Target
    5f40598d41ad834e13f75170f7bb3c3b08c24fc70bbc1af772dcb25ab2f1f956
  • Size 45KB
  • SHA256 5f40598d41ad834e13f75170f7bb3c3b08c24fc70bbc1af772dcb25ab2f1f956
  • MD5 910ff29462deb0e261de40d059c74571
  • SHA1 7218baaf6986d4f2ef0ba8acc250f9a2d9da2f6d
  • SHA512 b24a1d1e390f14cedbaaa035d6db00480d9534f36dad753efd82020694f76ee32523835b5e9aa7be6ec1f6b11c9494689c56596ff68d7602775736b7430815a0
  • SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qrbT2QAm7PI1PjbegX3iGwnTDGw8keqEiT+f1BDZkx:vuogpT7I62bT17bhXSG/GeZiTKbdkx
  • TLSH
    T117232A003BE88237F2BE4FB899F26145467AF6632603D58D2CC451DB5623FC6DA426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2