Extracted

• • Target
    056df09da8ae880b179eb8d545e151a32eb0cda9d05657428efb7612fe753eec
  • Size 45KB
  • SHA256 056df09da8ae880b179eb8d545e151a32eb0cda9d05657428efb7612fe753eec
  • MD5 c0f250f755e793cdbb16fbd164642076
  • SHA1 56a240eb90db29bc988a560ab5ed9eacf83bb9da
  • SHA512 21b2788ff4e156559b61e7d7eae8c02eb04f3f910bd0330ef052ffbf6ee675bc4758c4572cb89d4409243564ddbc1d25109417834b1b45c9725014d70f32d771
  • SSDEEP 768:guKWgSJTwU6NkWUGnaSmo2qAsj0UwPOlehAPITpzjbWgX3i2u/5XXcBDZwx:guKWgSJTwRf28j0/OghlTp3bJXS2u5qY
  • TLSH
    T179232A003BE8822BF2BE5FB89CF26145467AF6737603D6491CC451DB5623BC6CA426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2