Extracted

• • Target
    ef40af0b230761caceb5a9d6b16e2fb3e532f88ee8a94eac76ca3abc671a0114
  • Size 45KB
  • SHA256 ef40af0b230761caceb5a9d6b16e2fb3e532f88ee8a94eac76ca3abc671a0114
  • MD5 d3850f095541b562cd1e18a8963bb937
  • SHA1 90f5d07023fffbf2ff5107420e52409f7833722e
  • SHA512 37673da0bcccc88c5e4ff12b7c1c085a904e9d5da76d00be93c87a018dd967505062f8fa228297429effa01c1bdf051d91ef086637cfeefb42b0503a3633f2d4
  • SSDEEP 768:QuflpT8AkKuWUch7wmo2q9fozHy3CKPI2ljbKRgX3iyqjC9DZsSKGzOvBDZTx:QuflpT8Hv2BrR2tbVXSvjC9D5DzGdTx
  • TLSH
    T10B232B003BE9C127F2BE4F7499F26245467AF6633A03D58E1CC4119B5713FC68A52AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2