Extracted

• • Target
    934d1f951ef8d00fc04d45763b3be8c3e43db8c9905a9cb178944bd14fbc35ec
  • Size 45KB
  • SHA256 934d1f951ef8d00fc04d45763b3be8c3e43db8c9905a9cb178944bd14fbc35ec
  • MD5 587b93c522a2aa1f3480e7c892673249
  • SHA1 40af998f48c5e5381fd1d9918a72138821c556f0
  • SHA512 020135a123dd0f5ff420cd379c7699fae6695e59830507d72b036951adab349431e2c7c0888fa889399078069a3c1db8a8fc154ab9c25270cfdcbf9dedd33b62
  • SSDEEP 768:cuqb5TrIGuCWUoKXMmo2qQgls/cPEaRPIxijbngX3ibtqqrMNOQd6O0vBDZUx:cuqb5TrhG2E+aEaOxubgXSkAKd6OCdUx
  • TLSH
    T1D6232B003BECC12BF2BE4FB899F26145467AF6636603D5892CC452DB4713FC696426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2