Extracted

• • Target
    d3623d6a22622268058e3401a05c6ff62998477055f8197a2982a922a7bc4fdd
  • Size 45KB
  • SHA256 d3623d6a22622268058e3401a05c6ff62998477055f8197a2982a922a7bc4fdd
  • MD5 0a973bade4dd5f1c9942a5f26bbaebfb
  • SHA1 40a0e2c9a1530a3b1c765f7a101198818057bdc6
  • SHA512 826d2cf8f4d2cddbd0e1c974d99dbb5f59b4f91606fc8159ce015b18a8d4aea42ac60a12dd533c7acf141389f81c6c5b136b11c3b4cdf2e4a9b18623fe254763
  • SSDEEP 768:wuSOpTPTCFcWUeXa6mo2qAm9/gNzPIapzjbqgX3inEi+J5UAitsBP1BDZAx:wuSOpTPOP2tCap3b9XSn3+BpBdAx
  • TLSH
    T1F1231B003BE9822BF2BE4FB8A8F22145467AF6637603D95D1CC441DB5713FC59A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2