Extracted

• • Target
    3e2435ae56e28429cb60394fd429befd2a6b9c62ca4dbc3e6bac18826c2fd994
  • Size 45KB
  • SHA256 3e2435ae56e28429cb60394fd429befd2a6b9c62ca4dbc3e6bac18826c2fd994
  • MD5 e0eb07d943ef8f4c3802e642f663f07f
  • SHA1 809fa96f7910c2069ebb446a833838936e87aac5
  • SHA512 0b33d1e29f8f4e399e8ca5922caad52c007aff3daef8338c94409567e474f37143df552905899089a9d6af263a987434fdb2606255981b8ff863929a4b9e9aea
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1TgzZUpx7PI8ejbpgX3iUnq0DVsK6pOYODBDZUx:cu6YepTPso2Con8SbmXSUnrippO3FdUx
  • TLSH
    T125230A003BD8823BF2BF4FB899F26145867AF5633603D54D2CC4519B5623FC69A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2