Extracted

• • Target
    120d68e0ca7f323ce8844e12c2e29722932602bc0112aab193b0b3b17e189f60
  • Size 45KB
  • SHA256 120d68e0ca7f323ce8844e12c2e29722932602bc0112aab193b0b3b17e189f60
  • MD5 e605bf258d7037d699186c6bff58d448
  • SHA1 4f15d179376b29408bb5b90dd0abe30221eb64b9
  • SHA512 2508a39ee86349ab416cbea4be617dbb76b8f222926452022e627bf8d860625145f77088f9f0269588d6f6c9b57e07b5fd5a04a28c1214cceb7e7f69797ad45e
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qld3HE4eVoOPIGjzjbUgr3ik92L1iZEui156BDZMx:wuDWZTpMZSB2cU1o3Gj3b7rSOrri1+dO
  • TLSH
    T105232B003BE8812BF2BE4B74ADF26145867AF5A36603D54E2CC451DB5723FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2