Extracted

• • Target
    124eafd41cc0a8f4f879c4e3c76f7c03440da739dd53d3c1fb2c307555166076
  • Size 45KB
  • SHA256 124eafd41cc0a8f4f879c4e3c76f7c03440da739dd53d3c1fb2c307555166076
  • MD5 66933c550e942432850c5a99a7e057e6
  • SHA1 403d506c8098e63a409c98021b7554fec179af09
  • SHA512 8ac3d2c7f70dbfd23faf3c0421a29767d72042da599548aed42b2d9bafd66001e378cda6e472b59101e59c5917d757517e11df190a0b380f05be807a29a639e0
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1wL5P0NFUFdJYkk8PItzjbngX3ihOQVkitLGBDZUx:cuR0JTPjY2xLsm2Bt3bgXShmdUx
  • TLSH
    T157231A0037E9812BF2BE4F7869F26245467AF6732603D64E1CC451DB1613FC69A43AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2