Extracted

• • Target
    204d6573337e0f209ad1dc795d001f4ae73aa0cec82e95b4d0d4d3c159f2afd6
  • Size 45KB
  • SHA256 204d6573337e0f209ad1dc795d001f4ae73aa0cec82e95b4d0d4d3c159f2afd6
  • MD5 9c3ba652471dbde7caa1eeda8c02420e
  • SHA1 4352d2e24b38c063184168a0e7c603fcae0bedf2
  • SHA512 8528beb4394c57906650463add2b46379cec0ff6b7f7a4432c8a4eb23dd8cd4a1bf6fc955cfd6321042a966c948e7a8283f7ead7629a8ecbdac691e731abcae4
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVu8kLyuObvtkjZPICzjbWgX5ip8IPoK89iFBDZEx:MuBGJTPho2H8LuyyjWC3bJXIaWoKvLdG
  • TLSH
    T14C232A0037E9812BF2BE4F78A8F26145867BF6637603D54A1CC451DB5A13FC6CA42AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2