Extracted

• • Target
    e5726877383351f446b321d4fff48a109a458ec2f54858bbf345aaa07e05eb83
  • Size 45KB
  • SHA256 e5726877383351f446b321d4fff48a109a458ec2f54858bbf345aaa07e05eb83
  • MD5 544cb212a41eb2cf978dd6afae875a7a
  • SHA1 1a90e47d9a472349ba03ba663ebd17e6a27c7a66
  • SHA512 5f2372d72509b5ee43d548addb8fe8bcb3c8af1e732c2294613c1773bd4fc46e4a43e603ea6c819fc3c498a7b58671e98d2edab7354a71f86c0a8199414c290e
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFdm/9GgrOPIRzjb4gX3iiirltt5qFWdH89mhnBDZEx:MuLAZTnbg2um1b3R3bvXSimtfdZBdEx
  • TLSH
    T17C233C003BE8812BF2BE8F78A9F26105467AF6776503D54A1CC4519B4713FC69A436FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2