Extracted

• • Target
    f3832ada36e845ae11318b2d7c641723a8170d8395b24286ffd5215300bbf93c
  • Size 45KB
  • SHA256 f3832ada36e845ae11318b2d7c641723a8170d8395b24286ffd5215300bbf93c
  • MD5 dd9365ce736218e3cb6d542274f0f0ca
  • SHA1 29f135855a665d640f817dd7320c95437ee9c2ec
  • SHA512 37c60c114c6bfa527b7bb3ed5c21e39b1c911179decf4d2953fdcadbd2f4330aed682f17f7eb8b7566fcc10cec68fb758d7970f9f2764fa9886055e4f7e2b836
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVCT2Qpm7PIKLjb2gX3i2Lw5SDE8EConBDZkx:suJdpTPdI2+eKfbpXSOw5SDkVBdkx
  • TLSH
    T1BA232A003BE8822BF2BE4F789DF26145867AF6636603D54D6CC412D75623FC6CA426E9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2