Extracted

• • Target
    d40fb45d7a34ed35c63d73cd8391035ab2c3e549b0b5e982ca08fa2c1194aa56
  • Size 45KB
  • SHA256 d40fb45d7a34ed35c63d73cd8391035ab2c3e549b0b5e982ca08fa2c1194aa56
  • MD5 cc795234f6b0e1e13d88979f5f103b64
  • SHA1 029ea33fdcefdf92bedc19b0e06a6c36a0d4541b
  • SHA512 be6c61171929e4b5f612ea08f1a6825ff78472cc367f2a81c1e87ca1a389655042804465e3844226b60b42ea844ac089ea63ea423a9bd8fe55a3068dba9fc2bd
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVyL5P02FUFdiYkk8PISzjbxgX3iP9DMQL7OvbPBDZG:MuBGJTPho2/LDmhBS3b+XSPNKv1dEx
  • TLSH
    T117232A0037E8C12BF2BE4F74A9F26145467AF6736603D64D1C8451CB5A23FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2