Extracted

• • Target
    3a82925084be1c330689f435a0bb9bc041ff2228b4be6b34d38b3ca5c741485f
  • Size 45KB
  • SHA256 3a82925084be1c330689f435a0bb9bc041ff2228b4be6b34d38b3ca5c741485f
  • MD5 258e25dba8f2bc787bc615cdef730b31
  • SHA1 fc32e35015bd676476151643525cbb818b90c376
  • SHA512 3fc934d7490d7b18dce8d928c7b014a358d162a166c6ea1ad2f022c29a8f4de5c1fbd35588725dad2091192a475fa4ff6752b021f4d967967e87d1d34486c599
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYhoRQKISOPINzjbdgS3ibGTfPiohoXIAyBDZ0x:8uuSpTgyf2JYxz3N3bKSSb7ohoXIAMd2
  • TLSH
    T1EE232A003BE8812BF2BE4F7899F26245867AF2673603D58E1CC4519B1613FC6DA526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2