Extracted

• • Target
    3e0692f3a14c9306835e68801583a4e176a4b6c830b2a71abc13be2364e8cd2c
  • Size 45KB
  • SHA256 3e0692f3a14c9306835e68801583a4e176a4b6c830b2a71abc13be2364e8cd2c
  • MD5 46d296073417dc39b983db89fcc1a2a5
  • SHA1 9935ca0ad4d1342cef0a1d250477b4631f79a20c
  • SHA512 43d097af69760cde7c479b801a3783db701cfb515898eef11908c03fac668a53c4d532af07a3779ce83c9b7320739bfbaed1f0250312d860e985db1d13b559bb
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNKiacyPzlOPIpzjbegB3iJ0FvvWZlBDZ0x:5uSy6pTpoo2HiVC3p3bhBSr5d0x
  • TLSH
    T1C4233B003BE9812BF2BE5F78A9F26145867EF1633603D64A1CC411DB5713BC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2