Extracted

• • Target
    43d0afb108610418128d7e01694e7880b1e68b0c90eca0d1b1a6c232b9cc0f7e
  • Size 45KB
  • SHA256 43d0afb108610418128d7e01694e7880b1e68b0c90eca0d1b1a6c232b9cc0f7e
  • MD5 4b8a9efb7651ce6bb97f6e568f7d5b66
  • SHA1 32a832e1f2df48e086c47ca84d88572471939025
  • SHA512 4784434ce74351317a81cb757d0163d60f2fb5d2981783500033cd9b14d82383a99aed2993ef53c91ee16a236f6905b67ab3d39d5383ac99d8ae53960740f2c3
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9zwD/y/aqPIjzjb8gX3ijOhOa2Pg39Xyk5BDZ8x:0uPrpT/qY2Qkhj3bTXSjOhLaknd8x
  • TLSH
    T158233B003BE9C12BF2BF4B789DF25145867AF5633A03D6491CC4129B5613FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2