Extracted

• • Target
    a5b09503737d1ffd021284b82020cc4ba0b72f38c908bce370c843918e132f39
  • Size 45KB
  • SHA256 a5b09503737d1ffd021284b82020cc4ba0b72f38c908bce370c843918e132f39
  • MD5 348372a323ee76fca680314e1bdad140
  • SHA1 4d24b7ed1f693ae8ad76f7fc8f7f7d3f9cc3ada8
  • SHA512 622948bd1a090f1c1a522780d638c7bfd2a8c29da11fbb762075bc6c7d40e39b300049285580bebf0d1b7707e2a39eb62ea345d5edcabe6b480729d735ab35d0
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qldeeXKSocbbbQtN8/nPI6kzjbKgX3ib66cCEXJ3O:wuDWZTpMZSB2FeH2tNKA6k3bdXSb66YE
  • TLSH
    T1F5231B003BE9C12BF2BF5FB899F262058A7AF2732603D54A1CC4519B5713FC59A426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2