Extracted

• • Target
    40152f01ff23106eac27831928249927181ee470b3d20e6a984a8f1a2f376e04
  • Size 45KB
  • SHA256 40152f01ff23106eac27831928249927181ee470b3d20e6a984a8f1a2f376e04
  • MD5 5f33ed8c62496f305eff157aa959d9c7
  • SHA1 5188f4fe6b050013c6ca509ad5e31edd84a6176d
  • SHA512 389759be0fcf58751f83199285af8dba1df920e1aaba3931243d90df0bee249cc3ef53c073fd010768838e88676dceae624f7a9491043054002d064e77286458
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYfDEbHBqj2OPI/pzjbxgX3iocb8umNkPwoQBDZ0x:8uuSpTgyf23yoK3/p3b+XSoG/N9Gd0x
  • TLSH
    T1D9231A003BE8C13BF2BE4F78A9F26145867AF6633A03D5491CC4519B5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2