Extracted

• • Target
    620dbe70bcd5dfba72e8b0117b3170d6bbf626d1070aaaf6ee17acc49fbb17bd
  • Size 45KB
  • SHA256 620dbe70bcd5dfba72e8b0117b3170d6bbf626d1070aaaf6ee17acc49fbb17bd
  • MD5 67402f3c86dbfc1e8cbb962076a6cd5b
  • SHA1 fe416c8a24119c7bc94ac28513a13b02a1c69af4
  • SHA512 096fb5567f9d013b2f48294ac993862746d14ef956a48b29d5d836fb761765b369cc284798d9821dfd80b4b1426b41e1557cb7a54ec9a3732f30952c8fc807f1
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVyLiE0yFjrdjYkk8PIuJjbwgX3izqogouWE/JonJjm:MuBGJTPho2/LBXQBupb3XSz7W/UdEx
  • TLSH
    T117231A0037E9C12BF2BE4F7899F26205867AF6732903D54A1C8451DB5B23BC6C6536FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2