Extracted

• • Target
    200e8f32719662d2364da076b6bc230f72c2330f2cc8607413d11b142f96f044
  • Size 45KB
  • SHA256 200e8f32719662d2364da076b6bc230f72c2330f2cc8607413d11b142f96f044
  • MD5 0042885e11e63b1838df78acb59112d0
  • SHA1 840e8c802beb95e3c42c24f6b2835a3c56844ced
  • SHA512 b396b6e7dbea8b5b0bc461394ed359b3fcc8662970d2cef65645bd44f417c4ac3643f5eec8fcc64539d063228e0d31fd8aa558cd4ec05db006eb8d6d3d4c8a3e
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwnZTohEaSPIzzjb8gX3ihN40ONJYgBDZMx:ku40ZTXEb2d4Ea7z3bTXSk3LLdMx
  • TLSH
    T10F2319002BE8C22BF2BE4F78ADF26145857AF5B37603D5891CC451DB5713BC68A42AF9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2