Extracted

• • Target
    3dec98b40ab9c77bf0a91527e91f2dd743f72a518d40fd128b71d95017634789
  • Size 45KB
  • SHA256 3dec98b40ab9c77bf0a91527e91f2dd743f72a518d40fd128b71d95017634789
  • MD5 c135847fb7d3c64cd0ec86068ed5823b
  • SHA1 56d8667b7a2452063e319f6d2f0642995ae39ba7
  • SHA512 b626ba573b4035d26c78d1bec3b1eaa22fc6d43908b4e56bdb7ef87f929dd189630d4a19592eddea3805dbdb7992fb8180976f58d68915f83a30f2c5f95cd3a4
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFA7lt440WMOPI0szjb+gXpijMokkHmHo9xBDZEx:MuLAZTnbg2VgUM30s3bBXYGkGHQPdEx
  • TLSH
    T190232A003BE8812BF1BE4F7899F26145467AF6636603D58E1CC452DB5723FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2