Extracted

• • Target
    c3d89a0d3d7f2fe1be431c43830948946b240dadec68490c4969bb2bb1f716a1
  • Size 45KB
  • SHA256 c3d89a0d3d7f2fe1be431c43830948946b240dadec68490c4969bb2bb1f716a1
  • MD5 1e43ac47f21dee75153d6a8a92810490
  • SHA1 0d2ea70ded7be3ec99550ceb7ff7cd6fec0455fa
  • SHA512 02e30babdff90e0a75e704492cededcd9d7c6758bd4d2b891db75e1fcd022d112f073f80cd0e8ad5083256f639585405ca78df2543676a846af75d4bf82b2c8c
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9oozHyvCKPIiyjbXgX3i8KceWyVBDZsx:EufspTf2g20L5iebwXSf1Wy7dsx
  • TLSH
    T170232A0037E9C12BF2BE5F789DF26145467AF6632A03D64D1CC4119B1623FC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2