Extracted

• • Target
    3479c50ad32f13ba14fa1a9df39e9f081ae42f868fe6bc13da38b780a2efdf8e
  • Size 45KB
  • SHA256 3479c50ad32f13ba14fa1a9df39e9f081ae42f868fe6bc13da38b780a2efdf8e
  • MD5 d5a74e5b159436ac42c6a24188848906
  • SHA1 d9e9375c6523bac4a79a97d65eb9e6766f681867
  • SHA512 7d24f3ced773b8ef7219cd6c1c12679070c5698af557e70b7b35891fa2bfbc7b9647f646d8e90acfe71994e8075e5f93baa38ac14dc512abb9220d0c04f39676
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFhlsNoPEaMPIcOjbjgX3izpkvHQVuQYlHeJuVBDZUx:cu7e5TH2A2wsuEaxcib8XSzpaHlHeg70
  • TLSH
    T14C232A003BE88267F2BE4F789DF26245867AF6633603D54A1CC411975613FC6DA42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2