Extracted

• • Target
    3fd92949299aa31e2da0fcca471dafcb2e413019da45a2b12715c59f1ceec761
  • Size 45KB
  • SHA256 3fd92949299aa31e2da0fcca471dafcb2e413019da45a2b12715c59f1ceec761
  • MD5 281bb36b9db1869cebf7078eb60aebde
  • SHA1 1c803a1be15bc2a46ff4b1f4c676ecf9498c0041
  • SHA512 695cd5b864301a5bf6347c1cdf4f2cee1920a28387a8f9ac693099b0d764aefe575cfc7ee9a6913b34ea4e81be46655e490d30f2ecacef66c42e3c27d388a975
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4UzjHynaKPIsfjbwgX3iDYIWUMkcWhCOuBDZ0x:8uUIpT4vAj2wnZsrb3XSDnWUM40Bd0x
  • TLSH
    T1DE230A003BE9C12BF2BF4B7899F26145467AF6633A02D6491CC451DB5713BC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2