Extracted

• • Target
    a5090c651d1b17e3b82f605cb18d31803a94dc2c0dbde732e6b18f0a5bcda07f
  • Size 45KB
  • SHA256 a5090c651d1b17e3b82f605cb18d31803a94dc2c0dbde732e6b18f0a5bcda07f
  • MD5 9b6a0e85c1e593d98e46097f879e8cb5
  • SHA1 974e36d1fa8951aa191a31f82b8ef2f582c945c7
  • SHA512 22a6f0f2e53e17b534cfb9f113a0bff6ba6cb1e909fea3549c60182afe48c15ac359ac636bf764feada9e8945301be946200ac2fa2a6a1a5e5da8f13101436c8
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1wpt0CCM+d4CvS8PIMtjb+gX3i1PAbl6JkBDZUx:cuR0JTPjY2p/CFWBMlbBXS1PAbl6JSdW
  • TLSH
    T133232A0037E8812BF6BE4B7859F25245867BF5733603D64D1CC442DB5A23FC69A42AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2