Extracted

• • Target
    5e97acb9164b90b82d3c0955c180335569a6662c326bf4938906a9c0e0f84b03
  • Size 45KB
  • SHA256 5e97acb9164b90b82d3c0955c180335569a6662c326bf4938906a9c0e0f84b03
  • MD5 a23e2a188e663dd32917fc2efe7c7740
  • SHA1 cf18124f63e630302fa097ba7212f601e6c64695
  • SHA512 7ae3083619ec4fcf80cf4aa91e838aa267f0e3d033c127e4b4d981111121857e57a9bd86b5b748f32c2de3016dd21c03667b85d98ec0f244ec8201711cefe94c
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNfQ6vincPI9gjb7gX3iBFdgmXg7o1iPVBDZ0x:5uSy6pTpoo2pKU9IbEXSVgmw7o1Ed0x
  • TLSH
    T13E233B0037E8C22BF2BF4F749DF26145457AE6673A03D6891C8412DB5713BC68A52AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2