Extracted

• • Target
    435b39cf07c003be8c1d7e25b46e76607479620109f8d544e4cb58a556f6d0d0
  • Size 45KB
  • SHA256 435b39cf07c003be8c1d7e25b46e76607479620109f8d544e4cb58a556f6d0d0
  • MD5 d23a16bdae7ac50291a4078d78a5808d
  • SHA1 c205ab43865ea33f9d7b32c51b6b25dd4c4257fb
  • SHA512 c88daa0f0197ba39e11ded08f05a9de6682b5c639eaece2c2fc584ad4d274ea0c7a7d1932d16d92e9818956b1bcdc020aec8d70913965b81113cf3d60b65be45
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlUmJ5G6ROPINzjb8gX3iZblAl9neY9mC2NxwYbr+:wuDWZTpMZSB2vmD33N3bTXSZpAl9eu7J
  • TLSH
    T132233C003BE9812BF2BE4F789CF26145867AF6B33603D5491CC452DB5613FC69A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2