Extracted

• • Target
    5b64bc7d64659ae267eedef9ec0393a2386c74f5b495c6766d3bbd3a48a47465
  • Size 45KB
  • SHA256 5b64bc7d64659ae267eedef9ec0393a2386c74f5b495c6766d3bbd3a48a47465
  • MD5 fcba99b59db433247400ba809c06b02d
  • SHA1 ace656c4464441b12f7af2c6493f3cc4f2effd3e
  • SHA512 7a1b4bd33a334e31c0ad7625723df4febe72484f1b3aa8d3bc621b01262a49256c8180cdb946dac41ba562b3e0ad98a571a81a9720b7db764643f92539524c24
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFkhk6K7OOPIzzjb/gY3iB7dZK/Ta/pqw6BDZEx:MuLAZTnbg216VO3z3bIYSB7dZK7aowkE
  • TLSH
    T1D7232B003BD8C12BF2BE4F7898F26145467AF6676603D58A2CC4519B5723FC6CA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2