Extracted

• • Target
    5d6fc06c30960367e618054d7401531f93b01b091165d94ed1f731a3a2c5dbe3
  • Size 45KB
  • SHA256 5d6fc06c30960367e618054d7401531f93b01b091165d94ed1f731a3a2c5dbe3
  • MD5 0ae7cda1f58302ff7b9e49ca447488e6
  • SHA1 f02a4cb698cb53f6ff14e962f180bcd299618ec3
  • SHA512 5d8c9f62deca20fae83cffdf583ca166464d46272d12e58258c1613a9a763a515fc0512ecb6c10c17b27628d4f0d2f61d44e5784badf0bfaeda13cba6e42995b
  • SSDEEP 768:Iu5KkpTsU6Q8WU+xjamo2q1RxJaxMwHuPIvzjbdg03ihHCNIznGBDZLx:Iu5KkpTsx/24eN3v3bK0SxCNIzIdLx
  • TLSH
    T179232A003BE9862BF2BE4FB899F26105867AF1673603D6492CC451D75623FC6C6426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2