Extracted

• • Target
    12b2450040a2404bb6f784148c771534e014a6ac0930d1ffd69db0b54287b526
  • Size 45KB
  • SHA256 12b2450040a2404bb6f784148c771534e014a6ac0930d1ffd69db0b54287b526
  • MD5 9a8e63126538d2a2a1c1a8f663bb1eed
  • SHA1 7e99aa9a3998e2fcbe7e9fa29707b1dea1b994aa
  • SHA512 0962c0fa4ff63b80e33fd48de29f9f96f2ea4b6e561ae7cdb271a728ae55ba2b4fcce0d78a5d518dc7cd8e83aaddf925e4cd4e4c928c4cfb87433af0dce17cf6
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9Ewz/y3qiPIhzjbIgX3iBpXZHt+ZPBDZsx:EufspTf2g2v0hh3bfXSBHNsdsx
  • TLSH
    T1F8232C003BE9C12BF2BE4F789DF26145867AF6633603D6491CC4129B5723BC59A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2