Extracted

• • Target
    3410ab900a4ba63b9468a8ade0403aa3934d4f8fe064d0f7de188ef797dac8cb
  • Size 45KB
  • SHA256 3410ab900a4ba63b9468a8ade0403aa3934d4f8fe064d0f7de188ef797dac8cb
  • MD5 c995ba0e8699ae317c2bdcf4baddb45c
  • SHA1 bedcb5ffe6c01117128c3890bd43481b24b3edef
  • SHA512 a0aaf0acabecaf52cbb868fa52b7013b1e619e9273489a15444dbd81504b9aba440104a65d420d48ba2334ad8cdea72fca31e57ec116d238ca10df6ec143ee3f
  • SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q74CXtTtSPIFzjb9gX3i7tu9Z1ATp/rZVfldWBDZ8x:0ushJTDXgH2JwxF3bqXS2bQzZFP4d8x
  • TLSH
    T15A231B003BD8812BF2BE5F78A9F26245867AF5633603D58A1CC441DB5713FC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2