Extracted

• • Target
    5e4133f68af6618ee8587567a951eec80c806244009ee2e11c7a0ebf6ba73304
  • Size 45KB
  • SHA256 5e4133f68af6618ee8587567a951eec80c806244009ee2e11c7a0ebf6ba73304
  • MD5 d0ac1cd7bfcaf0ed333687114c84c63f
  • SHA1 097b4aa2a71b6a9d8edfd1d5ed5c6bef8ae473f2
  • SHA512 a9975658edc6cae92af26028765611b24e33508740ce72a289f314565bd39e635c6320f6a735151cb7a3e706e7b132f195db5ac2f23b0cb2ba77600f3ef8bbbf
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAmfPLzizpvtLjZPI9zjbRgX+iNDfBfavqCGCaaEBmtu:kuSOpTPOP2WfHi1VjW93beXH/avfGD44
  • TLSH
    T128233C0037E9812BF2BE4F7898F25245867AF6636603D54A1CC451CB5B23FC6DA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2