Extracted

• • Target
    3e03f5a4631e540cc5afbaf34bd19d1e72b07eff682934801dee12e3051f18c8
  • Size 45KB
  • SHA256 3e03f5a4631e540cc5afbaf34bd19d1e72b07eff682934801dee12e3051f18c8
  • MD5 faf229734ec747fd152a7a005ac3d5d2
  • SHA1 d3117ad8bdf2f56d3fb00eae2ca0260ee10dc4ca
  • SHA512 57219ef52401c260c34e6903d144724f6ec224c6b3f5d6b52c68faf4d659463e653e6df3275d5505f8a722cfb8329b9d1b8a26d1c523f332070f4548e82d0003
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1910CnMQRPn98PIQijbNgX3igr34TiwgNrBDZUx:cuR0JTPjY2ktnbvBQubaXSM4TiwgN9dW
  • TLSH
    T1AC231A003BE9812BF2BE4F7898F25245467BF5736503D5491C8452DB5A23FC68A43AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2