Extracted

• • Target
    40cccbbae87f8982cd8e57d0ca4f6934cc5e5c0162b45eb07e704b7e42806cfc
  • Size 45KB
  • SHA256 40cccbbae87f8982cd8e57d0ca4f6934cc5e5c0162b45eb07e704b7e42806cfc
  • MD5 e37102cbebe6c363741069a34ff254d4
  • SHA1 cae7fa0fd95fc8d1ad60711ba49a888642e98623
  • SHA512 ec38361d493e709e5224b4fb007090f2a0560f96575b9f688f008cba4d3561cd5cb3cefccb454aeb59b82b9c2ff3c3a44cf20717cabd1e3fed1d47b83fa70e87
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1B3wZQaKkPIozjbbgX3ia4eGYf81y9ABDZcx:RuxkJTgip2nIo3bkXS1eGYf81y9Wdcx
  • TLSH
    T1E0232A003BE8823BF2BE4F78A8F25145467AF5637603D9496CC411DB5623FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2