Extracted

• • Target
    0ed20f189114d08092e9b58cc0f523b8c2722628edb49864861de982fd38823b
  • Size 45KB
  • SHA256 0ed20f189114d08092e9b58cc0f523b8c2722628edb49864861de982fd38823b
  • MD5 ad9fc9360a396f0ed691016d5e543fb3
  • SHA1 43511097c6a00a859acb1a12cc824221ebb6bb05
  • SHA512 cf74768d4e7292b87ac1a9214b39889ab7a534adea21d724c252b62faa10dd700bb7995aacb6cc9cb914feed0e66ba227909114b16aceb5c388412893b823dcb
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAhpt0CCMhdjCvS8PIjijbBgX3ihMKlhdH+NKUKi/BDo:kuSOpTPOP2x/CChBjubuXShblhd+UgJ8
  • TLSH
    T168231A0037E9812BF2BE9F7499F22141867AF6732603D54A1CC451DB5A23BC69A436FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2