Extracted

• • Target
    d03aae765982f503304c5a63fc8c325c616a2a40d6e70939c9ff111ed2fb11ff
  • Size 45KB
  • SHA256 d03aae765982f503304c5a63fc8c325c616a2a40d6e70939c9ff111ed2fb11ff
  • MD5 2a7329780d7ac228e02ac2f99ba14b9c
  • SHA1 f0fb8940bed7553226efe35075bd70345eee7043
  • SHA512 09023cdfc71742fcf2342e9b21e1a0a91160382f53ab8677cc3c0a87046aca58b8412b0e16a361eb1dc0bc78188903f3376c07aef407b14f79f9cfba849a4b69
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9oozfy3CKPItnjb8gX3iRyG4gZLbC5wVXzBDZsx:EufspTf2g20TRtjbTXSN4+bLVXVdsx
  • TLSH
    T142232B003BE9C12BF2BE4F789DF26145857AE5633603D54A1CC4119B5713FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2