Extracted

• • Target
    43be408455a960968f05a91b1fb2210783f03508b4729e7e5446547b3c868b1a
  • Size 45KB
  • SHA256 43be408455a960968f05a91b1fb2210783f03508b4729e7e5446547b3c868b1a
  • MD5 35ac494797f039b0598616ca82b1a64b
  • SHA1 fe71aeac36a97114520b67c38bad0941dec18bdc
  • SHA512 26297d0808c55ce3dc003d759636c93931b29a15b91e30fff168d4399ef1d5982d44c9e0607526a8fdcf344c256a67e1c84d89f9eae21a7b3a95f87d103d5bed
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVrT2Qpm7PIGHjbIgX3ihcrpVaa4BDZkx:suJdpTPdI2JeGDbfXShypsa+dkx
  • TLSH
    T12B232C003BE8823BF2BE4F789CF26145867AE5637603D54D2CC452DB5623FC68A526ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2