Extracted

• • Target
    5b5f1c5dba1c659ccddc41aef5906d0c27e8a8fd61e8c6164a51aec50039a9c4
  • Size 45KB
  • SHA256 5b5f1c5dba1c659ccddc41aef5906d0c27e8a8fd61e8c6164a51aec50039a9c4
  • MD5 bd0a148dd529a404f086c490ccb23555
  • SHA1 7ccb0b1e98f73ee52bff698220b748e7e7166658
  • SHA512 89d14aa880196d14f616dbe95bedaacd80118a524a6237b23d5bc8e55dde4716e9123b420c983d17345c2cc86bdee84782bde8ee4ddb6db60778c542a52b0b33
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFw3HO4SNMOPI0azjb5gA3iBpMAFXMYjBDZEx:MuLAZTnbg2R+JM30a3bWASBSASQdEx
  • TLSH
    T191231A003BE8812BF2BE4F78ACF26145467AF5673603D64E1CC4529B5B13BC686426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2