Extracted

• • Target
    c3817df423cd673e5c7f9b89772a5d6367e3859e73b903760596a06723386e94
  • Size 45KB
  • SHA256 c3817df423cd673e5c7f9b89772a5d6367e3859e73b903760596a06723386e94
  • MD5 cc99ab4bfb96ed7c6526633a5317af92
  • SHA1 8d506581d132437bd9dbeaedcd20cd94a960e669
  • SHA512 f188537b72ab00c9680aa02940ff0d0ad6df3607eebeca689be9728326a9f359941f7b70aceee4258f8dfbe1b67e4d303812f4c96a9d972a0b16e6bb3c5073b6
  • SSDEEP 768:cuqb5TrIGuCWUoKXMmo2qQNm/9GgrOPIRzjbggX3ineuWRXerLJU8HMBDZUx:cuqb5TrhG2Zm1b3R3bHXSzoXPTdUx
  • TLSH
    T10F233B003BE9812BF2BE4F7899F26105467AF6A37603D5891CC451DB4B13FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2