Extracted

• • Target
    40c9e05182992f38da0e3c9329209eb06afd85bdd0fa6b0f09c69aa15fb9bcb7
  • Size 45KB
  • SHA256 40c9e05182992f38da0e3c9329209eb06afd85bdd0fa6b0f09c69aa15fb9bcb7
  • MD5 064014c299b97f758779a6c5b4c7cce3
  • SHA1 c2a29d3176851a04b06ef61d36a6e67ad78d2480
  • SHA512 2818cd569f0ce13b248e5a8ac03d919a6a02c535a4027df1aecd85c1d28119b549a1607f34b70dd0557412a24c722138990f4586a0d2bed406e02832efadba51
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFKBl3u40cMOPI0GzjbigXNiygXiGoJx4ZleOBDZUx:cu7e5TH2A2dk+M30G3bFX89Xil4ZleA0
  • TLSH
    T110232A003BE8812BF2BE8FB898F26145467AF6B32603D54A1CC451DB4713BC6D6526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2