Extracted

• • Target
    3fbf9618c680f270f412a69e7c71825519ae39d40725fb807890a7db13e6d9df
  • Size 45KB
  • SHA256 3fbf9618c680f270f412a69e7c71825519ae39d40725fb807890a7db13e6d9df
  • MD5 a17d2e19b629ce44db546fe2453b7d91
  • SHA1 66b2fe2c7c3216878a81dc0f10c66c76c2530089
  • SHA512 978bfb06c7a8276e298fe820becb430839b9bdc2ff1cb9f89eb67fb77e0b3fb3d9a3f4b087c70914d724717eedfa040963fa3e9721b3313e723ff7f0572c71a1
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtm/cYssPJZOPIcvzjbwgX3i8SVR5TG/aa7pfrNBDZ0x:5udApTNmU2ZMIf3cv3b3XS8SbtzaN/d2
  • TLSH
    T106230A0037E8C22BF2BE4F78ACF26145467AF2673603D58E1CC4519A5613FC69A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2