Extracted

• • Target
    5d7e1c6e5e89f667f9e46d9466b9f48d4a8383d8511c9503ff7918dec60bdbe4
  • Size 45KB
  • SHA256 5d7e1c6e5e89f667f9e46d9466b9f48d4a8383d8511c9503ff7918dec60bdbe4
  • MD5 7bd9d1fb201c4e56ba5646f57ddb26d4
  • SHA1 10caad4c9d60e7914a6301fb6ee7b5763749012e
  • SHA512 a479ad1ae2087c44851b685ce28738e288c0294f3b30175d0fb401defe1006e62151b6481b0e2a4d5e849c143a67987bcd094a98bf4b90e33053f32762433140
  • SSDEEP 768:Iu5KkpTsU6Q8WU+xjamo2q1TeqpG3jHuPIMzjbUgXLiq3c8RmTuBDZLx:Iu5KkpTsx/2uzM3M3b7XG8BmTgdLx
  • TLSH
    T17E233A003BE9822BF2BE5FB8A8F26105467AF1677603D64D1CC441DB5623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2