Extracted

• • Target
    5c0fdaf8206fd2e84e2bd87132bee4d3e175fc376132b1e3079f84e0b1228744
  • Size 45KB
  • SHA256 5c0fdaf8206fd2e84e2bd87132bee4d3e175fc376132b1e3079f84e0b1228744
  • MD5 a7432122897dffc5f00ee49b3276a4e4
  • SHA1 40bf27597e3342a3adc03aa6d422a3537e5599db
  • SHA512 d839fe02499ff52e36190ac7509b3e8ca83da64b71aa948b108ea2c8128ba78771a7f397f76fc392f1bbf33160dfb2ae2f74e38c33d2091abaf7d3325c2414b7
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qA2/ycD3APIMzjbsgX3g2DBWz2CbWeitBDZcx:UuKWgSJTwRf2mq+3lM3bjXw2DRHdcx
  • TLSH
    T114233A003BE9C12BF2BE4FB8A8F26145467AF6637603D64A1CC441DB5723BC696426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2