Extracted

• • Target
    57b4436ca28df684771c1f797e0597c37115e295d6f586e9151454974e0f433c
  • Size 45KB
  • SHA256 57b4436ca28df684771c1f797e0597c37115e295d6f586e9151454974e0f433c
  • MD5 d4fa7f44054864bf8e6bb6e4131c6452
  • SHA1 fe6515db3d33972bd913bc1782fca70598dedccc
  • SHA512 c96b301e02ef153956c329e10eb1abe74f389fbb22a4dca5033aab4207748a9d523082d979cf42fbc16ca0f5b77696b098253c0d7ac7295edc3ec6ef414c7432
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFM3XodEayPI0zjbegX3ivhhnLex1q656RgVqSBDZUx:cu7e5TH2A2nUEab03bhXSvhQORjsdUx
  • TLSH
    T152231B103BE8822BF2BE4F7899F26145867AF5637603D54E2CC401D75713BC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2