Extracted

• • Target
    840e821d61e942eca923d4d03feb23b2f5d765f6198ca02a11e1ec2a39e963ef
  • Size 45KB
  • SHA256 840e821d61e942eca923d4d03feb23b2f5d765f6198ca02a11e1ec2a39e963ef
  • MD5 aab98df867827c7f1cf7aa60ed259ec3
  • SHA1 09910be06b1be927a90067d117704046e7cef5fb
  • SHA512 604b59d6b080e483d7dd846255ec3696e32f7af3ad958715cb8477ae06890d916d7f0cfc468682bbb52f2bc90423146652ff58a6babcf0196c013eaf21ce6e1f
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFENd3u40cMOPI04zjbJgXCiBe1KZ9JsOi5NBHXpBDg:cu7e5TH2A2T8+M3043bGXrBeojfMRX30
  • TLSH
    T17E2319003BE8822BF2BE4F78A8F26145867AF6677603D54A1CC451DB5713FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2