Extracted

• • Target
    020cb2219b0fedbed3997247ac83e7b7dee3a7e1826050e0198fab528497fbf3
  • Size 45KB
  • SHA256 020cb2219b0fedbed3997247ac83e7b7dee3a7e1826050e0198fab528497fbf3
  • MD5 6ca9ace077daafbf1200ba7be66dd372
  • SHA1 7ad6e9f786e34ff123539700a77b8b4e3ed0579d
  • SHA512 3f04de26eb075bc7b641238848dbe8512e98e5012be43d9c21cf8006d3423d1ccc05833261e35a2f359ff8a97e150f517052a49d7b2163cc6a182824c9b1dd37
  • SSDEEP 768:UulLJTEs+EgWUKJTGmo2q9kGFZQjB4PIFfzjb8gX3ir6NJk5r4131dnvRBDZfx:UulLJTE9X2cqF9Ff3bTXSDsd3dfx
  • TLSH
    T153232A003BE8813BF2BE4F7898F26145867AF6773603D54A1CC451DB5623BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2