Extracted

• • Target
    400dd8a9610f7fc8d5942d9a00f6844f102a90d9f961583a716478e2ea2472fe
  • Size 45KB
  • SHA256 400dd8a9610f7fc8d5942d9a00f6844f102a90d9f961583a716478e2ea2472fe
  • MD5 f75604a7de9d1ba91e7f86c02633c732
  • SHA1 60fc2d59192ab958dfde3a781bef1cf9dbfcb6bd
  • SHA512 ce57194686509f8601f34635a2a69e66341d59a6a0e1151df4c093d495c4e9a322000a12712b7cfb507717081b4d76fdc57489246acf3908bee883aa8670e0f9
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qA0Gju8eQlZwZPI5zjb7gXOirc49eCNbj4c4BDZMx:kuSOpTPOP2kGjuVGwW53bEX3rc6URdMx
  • TLSH
    T15C233B003BE9C12BF2BE4F7869F21145867AF6636603D54A1CC441DB5A23FC6CA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2