Extracted

• • Target
    058dcafd291cd8ed1aab2c50a09d15b1d5997296fd1dcf67bf64756bdc1e059a
  • Size 45KB
  • SHA256 058dcafd291cd8ed1aab2c50a09d15b1d5997296fd1dcf67bf64756bdc1e059a
  • MD5 e0ddb21b496ba40202f41bb45a625c34
  • SHA1 3d4ae5de56bcf987888b1c3e8646ca2408065fb4
  • SHA512 8d2788182937b951b0973a96ce3d5ee584ba1203cd297e44d0dd23463ab1854f987ebcbf159cfae6be7381364366065d56059ba00e6bbc6025a52ead84d83293
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1ZxGZGP9HuPIFzjb6gJ3iVgMOc/NpDlB/BDZcx:RuxkJTgip2gGa3F3btJSVgMOSNTBJdcx
  • TLSH
    T15A231A103BE9C12BF2BE4F7498F26146867AF2637603DA491CC441DB5623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2