Extracted

• • Target
    3a2eb3617e8751663143f18acf575e0cc2bb43acb00d6c3bc403f7ad37a951f4
  • Size 45KB
  • SHA256 3a2eb3617e8751663143f18acf575e0cc2bb43acb00d6c3bc403f7ad37a951f4
  • MD5 b1049b9b122463d5f7a3d0438a1bb5fc
  • SHA1 84c63eb1eeb8d08e90c1fa031ebb7390170ae5be
  • SHA512 e299090825b0914b375d6e10a54f9a674340d45da4c1648264f3792fb2fb9fdc56949525128cc48cd226114ec0f29b5cac4d4c85f72393f53793e97e7da27e4f
  • SSDEEP 768:4uLZZTUAoOSWUYZL8mo2qFhAUdueMYl58FnPIMOzjb8gX3ijou+bi0t68IOYegB/:4uLZZTUTn2zUFpl5wAMO3bTXSjMZ6hOi
  • TLSH
    T1B9232B003BEC8127F2BE4F7899F26145867AF6633603D58A1CC452DB5723BC696426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2