Extracted

• • Target
    5a57dfcd5674774e6a45f054c0a6b53c399de115c62a26a65ccf1935b24ff7c6
  • Size 45KB
  • SHA256 5a57dfcd5674774e6a45f054c0a6b53c399de115c62a26a65ccf1935b24ff7c6
  • MD5 dd28d47cd1f829f6796cfb427b274b21
  • SHA1 24ba9ef5ca5300d89c8ce5a4586fa30f586b8997
  • SHA512 8e50de897936a24441e8530a72b5e73f5d5b81f4261abc588c7cf28fe502af31695f547097cff4c3eeeb3e936954d219f0341fbbfb52051961505748274af3b6
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1r9PLzizyvtLjZPIXzjbSgX9idY2DAK/Rl342xfoBDg:cuR0JTPjY229HiGVjWX3bVXMdY2Df/TH
  • TLSH
    T127232A003BE9C12BF2BE4F7899F26245867BF6637603D54A1CC441DB5613FC68A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2