Extracted

• • Target
    3f1666894484895137ab01d65129853560018c1cb0984d5c1def2d50383746ba
  • Size 45KB
  • SHA256 3f1666894484895137ab01d65129853560018c1cb0984d5c1def2d50383746ba
  • MD5 2b21f3b4f8886fe1b7f61d6675b573f5
  • SHA1 0857aa6bf10b2397c9a421764e6564bcf7c78170
  • SHA512 980fdf6437cae0a58d18bb63e43ccbf333151f9f14e6e653f0920756eed3827c550aca66db49de38a204bfb3cad871c71873419f3074be8ca5459772aeea2700
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAG8V1yp7EcPIpzjbvgX3iDFE0WN+K8jlBDZMx:kuSOpTPOP2W8V41Ehp3bYXSDFoZurdMx
  • TLSH
    T163233B0037E98227F2BE4F7899F26145867AF2672603E64E1CC451DB1713FC696426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2