Extracted

• • Target
    56620c0b6d703f1e3e5240bc5548f6a59539b98a3e256b5a8a86e925a3739ad0
  • Size 45KB
  • SHA256 56620c0b6d703f1e3e5240bc5548f6a59539b98a3e256b5a8a86e925a3739ad0
  • MD5 b106e3af2c48a237cd37d3a04bc85198
  • SHA1 b262b3d559ecfe9217edc5717519336a6ad792c0
  • SHA512 243029cd4c242ea5a440f2e2118371634251bdb1d9049c689d1d374ad4c42a50fbf3949f29c51c8d7b4571b690f797ef339bbd0433e007d753ed0812c3bef2a8
  • SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7lCXtTtoPI7zjbhgX3ie0KAtSmReQZaBDZ8x:0ushJTDXgH2Mw373bOXSe1mYQZEd8x
  • TLSH
    T170232A0037D8822BF2BE5F78A9F26146867AF5633603D54E2CC4519B5723FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2