Extracted

• • Target
    125f0d8c3dc420eb72f5101b2d5bcce12f85b4083c98fcfa3fc3274cfd59d0d7
  • Size 45KB
  • SHA256 125f0d8c3dc420eb72f5101b2d5bcce12f85b4083c98fcfa3fc3274cfd59d0d7
  • MD5 2c7f5861b7b275dbbe39a20f459a3ec0
  • SHA1 2921dd20c78a7093314ea6e70376514e6a139d7d
  • SHA512 57c42f2b7de142d3e0e7f2ce8524dafa1b1d817805c16b78122031ccefeb93fff41a3aa22182b51a42c45532eea880b6d6bdd6622c65dbabfba55cc907949ea9
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFvlsHoPEajPIZ1jbKgX3i0//QpcWSNSaqb1BDZUx:cu7e5TH2A2qeuEasZdbdXS0//0cRvmdW
  • TLSH
    T139232B003BE8C22BF2BE4F7859F26245867AF5B32503D58E1CC4519B5713FC69A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2