Extracted

• • Target
    d3409142fe9073b599f0c649b0eb971455ef16a48caacfc04b72e0e0dc43061d
  • Size 45KB
  • SHA256 d3409142fe9073b599f0c649b0eb971455ef16a48caacfc04b72e0e0dc43061d
  • MD5 cedf8f6a9af2340f4565953ce1baa4df
  • SHA1 3eaf1552d087d4d6f29e902cd1f413cfedaf87e0
  • SHA512 312381e9d2af39bf9258f5d8d4c9c36b288a65bf04e2a64328b97edf2be0f6e7a898b44eb2d76ef26ad1b194edde1e5d4655fe576a94d2d8f5ef824804f7b375
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9oozHyvCKPIiCjbfgX3iqVzK6/CtpgDwfBDZsx:EufspTf2g20L5iOboXSqzHCzgDGdsx
  • TLSH
    T1B3232A0037E9C12BF2BE5F789DF26145467AF6633A03D64A1CC4119B5713FC68A42AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2