Extracted

• • Target
    42a46e8341a1d1deb8dd8dfec875dc8fbe75575619693daf42e2ae733376e994
  • Size 45KB
  • SHA256 42a46e8341a1d1deb8dd8dfec875dc8fbe75575619693daf42e2ae733376e994
  • MD5 60e68e5f0d55d77169be3abb41c417da
  • SHA1 c748a363fbedcc578ecd55db39aff7ae32607385
  • SHA512 22f93e6e878b3aa7bbfe7c095f690262b366748e57b3670338d4b4e4cdf2feb9d8fa245a09d0f759f460dca7809d1a22753294c26a12d0ffca79ab687f6eb1b2
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qw8fBohEaEPIQGjb9gX3ixH5PLQsDBDZMx:ku40ZTXEb2C4EapQqbqXST9FdMx
  • TLSH
    T15C233B003BE8822BF2BE4F789CF26145867AF6637603D58D2CC451DB5613BC696426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2