Extracted

• • Target
    3c1d47bfdc8735e043ce50364fc3d5cadea1ee8b95bcd3370c5842f5a4f49c90
  • Size 45KB
  • SHA256 3c1d47bfdc8735e043ce50364fc3d5cadea1ee8b95bcd3370c5842f5a4f49c90
  • MD5 13f3d522934c8ef732e7033da13656f3
  • SHA1 9340e45f93628e1479bbddc80b663f9774aacac4
  • SHA512 0c1bb6a5e82029cfcc510b1f09dd053e4dfc523659b24f1707cfbe00f71d7fb1d4c9f995f4a53971eba91b4fffd1d28e0b23f750031e488de7c9f1822366fa25
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9tCSwTMSPI5qjbjgX3iVhlpCTMvufDeaSBDZsx:EulCJTHl42agG5mb8XSVhlQMvurzsdsx
  • TLSH
    T10D231A0037E8C12BF2BE5F78A9F26145867AF6633603D6492CC4519B1623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2