Extracted

• • Target
    3d2d127fec4cd783f35de6441cca652bc79bb16c5fb2a77ddf42a00ba2f78e60
  • Size 45KB
  • SHA256 3d2d127fec4cd783f35de6441cca652bc79bb16c5fb2a77ddf42a00ba2f78e60
  • MD5 24ee347f1d573559d3a69d0d07e4120b
  • SHA1 cb1cf6dd709771855fee05a62351f499003498b1
  • SHA512 23d83a5d7355c669e3fd50f6690012d0d4eec1d50e1d48bb35a3522d70500e1606fadca434cefeb399aff671edab870fb7e1cfa4e1d551713745064153274a71
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwg3xY6AZOOPILzjb1gy3iqeRkoD0YkFnBDZMx:ku40ZTXEb2culO3L3bSySqeNQBdMx
  • TLSH
    T1A4231A003BE8822BF2BE4FB899F26145467AF2737603D5491CC451D75A23FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2