Extracted

• • Target
    52b65adc22a7988dce75f4badbe96933ff5daaaae240eb1457cc739a006c1617
  • Size 45KB
  • SHA256 52b65adc22a7988dce75f4badbe96933ff5daaaae240eb1457cc739a006c1617
  • MD5 20ae8ebe79e52639e166a7e8755ae91f
  • SHA1 e41935fc298ebfc8fd9952b6fedfad73da834859
  • SHA512 d9d6c709511c9f447d870555b857f6162465821861ef7bf0062fc9f4c4be4b43c03c3b70d33372cde384c21bc5459e1a0858216eb9ce311d7265aca4ff9d701d
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9LqAYaayNPIHzjbmgX34QaV6rbLY1TLxdBDZsx:EufspTf2g2WqzqqH3b5XINVRBdsx
  • TLSH
    T17B232B003BE8812BF2BF5F74A9F22145867AF6633603E54A1CC451DB5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2