Extracted

• • Target
    03ffa39e6840cf0e373cb477ea507ef9365ca4967db6a54f31dbd039211c0893
  • Size 45KB
  • SHA256 03ffa39e6840cf0e373cb477ea507ef9365ca4967db6a54f31dbd039211c0893
  • MD5 0237700a198ae92005cd4967e40a4f51
  • SHA1 641facdca7b1a48963762fe27fdce511f88332a1
  • SHA512 d7a3d39e288f649503ba21389ea35041d61e0611830108c28690f126d4a004e8fea6ed3c805fa3e4ac81ba8983815c94993c20335385172c40128a33affb7d67
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwB3FoDEaOPIgzjb9gX3iil/cIFi52EPRBDZMx:ku40ZTXEb2nKEa3g3bqXSC7E5nPvdMx
  • TLSH
    T134231A003BE8812BF2BE5F78ADF26105867AF6B36603D5491CC441D75713FC69A42AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2