Extracted

• • Target
    3e3e1d646ca67e0dd556a7c2c95f898b0db98affdd65496b64e94773c5ccfcf7
  • Size 45KB
  • SHA256 3e3e1d646ca67e0dd556a7c2c95f898b0db98affdd65496b64e94773c5ccfcf7
  • MD5 b1ca38e9766a26c444a2d7cf4f1fc7bb
  • SHA1 b72a7a3cdd8e4fdf4428b55caaf6095b10e923f4
  • SHA512 df2258d76bef20449ca3f6e039ca51a884ddc6ffd3643cb0b766569b40770643d37c78a8c9b0d6f42294ce51d887a7c5afd30ad0fb569c8f09cae2ecdd8d3071
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9dZotDMxPIU5jbagX3i05d9QmBDZ8x:0u1YJTHcw2G+zU5bNXSY/Jd8x
  • TLSH
    T11C231C003BE8812BF2BE4F7499F26145867AF6773602D54E1CC4519B5623FC68A42BFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2