Extracted

• • Target
    ca5b84de7b0ffc3e7c43643c43aeafa62f1d93e26c1c1aac4b84a54876687975
  • Size 45KB
  • SHA256 ca5b84de7b0ffc3e7c43643c43aeafa62f1d93e26c1c1aac4b84a54876687975
  • MD5 96f42219e20062fc7803f22c9f948c4f
  • SHA1 8e38ed348c9f44df1e5610348dede28d5d625158
  • SHA512 c586ba911a0e3377d12905255e4d45a12b3dcb0586a776611c9ef2929b25aa4d9562d75b8f6295bbd964976807fecde47e33d895ff533ba4eba938811ec1d354
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1HqJaxjwHuPIPzjbTgk3i/Ok0V83Jb6Ygv6R3BDg:cu6YepTPso2S3+3P3bMkSGk/5b6YDRx0
  • TLSH
    T1E6232A003BE98127F2BE4FB4A8F26145867EF6632603D64D2CC451DB5713FC696426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2