Extracted

• • Target
    3d52e3272357d08ee88e2c534bd4dc246126a5714579491f489bc7fc3c5250cd
  • Size 45KB
  • SHA256 3d52e3272357d08ee88e2c534bd4dc246126a5714579491f489bc7fc3c5250cd
  • MD5 bdf7de8aee394c07006fff18b28b9543
  • SHA1 1ec7f78e88f6fd254db9c8d7e2441bead46b197a
  • SHA512 68ccf892dd523659dc6fab552a5da6858b91fc64de85d0293ca857b29bfe426a92d9ebb877a5ebeba75b933602ff4c19423614fe4a346a2073e01db3b98c5056
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9JW8aIXOPIKzjbQgF3iJ/0sXdDgcjZsinqUOoBDZ8x:0u1YJTHcw2lFu3K3bXFSJ/0mUssA1d8x
  • TLSH
    T140231B1037E8822BF2BE4F7898F26145867AF6673603D58E1CC451DB5613FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2