Extracted

• • Target
    3d544e045c2bf3d32a7be605d0a776ded56d97948b86a5eca454021b0c773ea7
  • Size 45KB
  • SHA256 3d544e045c2bf3d32a7be605d0a776ded56d97948b86a5eca454021b0c773ea7
  • MD5 fd35ddd0059e05932b45475b8ce8bcdf
  • SHA1 7e35571bf0578da219763e55e0df322270c78e8c
  • SHA512 39fdd0a04013123d81e697d6629766e22827f12d530deab83aae20488927d65416bc31470d95b21d592dbc31decc3e66fb129c3f15c40123d18d60364bf900a9
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9zwD/y/aqPIezjbRgX3iYxKGCZUcBDZ8x:0uPrpT/qY2Qkhe3beXSpVZxd8x
  • TLSH
    T1A5231A0037E9C12BF2BE4F7899F22145867AF6632A03D5891CC4119B5713FC6DA526FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2