Extracted

• • Target
    5fe7cd230f0f36ff8bef41835708defae2b2a67d2e9788421600dad1aabc1493
  • Size 45KB
  • SHA256 5fe7cd230f0f36ff8bef41835708defae2b2a67d2e9788421600dad1aabc1493
  • MD5 63223571a2cd9d9fc0291b9a2d3da76d
  • SHA1 f3e51f8f8e7abd9236e37a592a08b2a1ff9aa1d0
  • SHA512 7975ee08f76542433ff198187efda490cb2e415e9858f9f52227e993d4bb4230c28dffae4d4399aab2f9d6b7f912a23a965a3aa28bf8b8482bbbe5186704f5b6
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVOT9Qpm9PIZzjbHgX3ikohvPkYNvEACYhDUBDZkx:suJdpTPdI2ZQZ3bAXSZhEECvdkx
  • TLSH
    T1E0231B003BE8C23BF2BE5B7899F26145467AF6632603D54D2CC452DB5623FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2