Extracted

• • Target
    40b57b22b53d925e662542c53ab5362c55d9e06730de633a0056e793594f786a
  • Size 45KB
  • SHA256 40b57b22b53d925e662542c53ab5362c55d9e06730de633a0056e793594f786a
  • MD5 51a5de3921f43c084d5a134b7b0222eb
  • SHA1 15950696445ad717eff406cd456f65e11a2b7c52
  • SHA512 342b77d1a4a4363bb8feb611d00fd3a9082a9e1940c1c7f34e1980678e9c5e2d81826e6225bf1adc43588093c0b9f2b0acf1941085f91ed66a63d4b67ff6b256
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVyL5P02FUFdiYkk8PInzjb+gX3iXR6yfSR3yBDZEx:MuBGJTPho2/LDmhBn3bBXS4vR3MdEx
  • TLSH
    T15123090037E9812BF2BE4F74A9F26145867AF6732A03D6491C8451DB1B13FC69643AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2