Extracted

• • Target
    118ed3e4c70a58ffee2122492f90af7a3397980e707e1c51536aab6e1c6e673a
  • Size 45KB
  • SHA256 118ed3e4c70a58ffee2122492f90af7a3397980e707e1c51536aab6e1c6e673a
  • MD5 6b94278c73e5936424d572a9d93d59db
  • SHA1 900edb8ddc919324cf659500ee737673f1d4e911
  • SHA512 f55797ca2348a4c92079034a4b825898ef0ce74923b44017fe282dc2318b9e4add07557a644cd5088b9da770db6420c5c31396b2d6b3dc8c72b5833f015a3a70
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9LK1YJBOPIxq7zjbdg03iMuV6OusXEWzHVNKJBDZsx:EulCJTHl42riz3xS3bK0SrRus0Wz+Xdu
  • TLSH
    T12F232B003BE8812AF27E4F789CF26145867AF6673A03D54E1CC451DB5623FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2