Extracted

• • Target
    3aa671f079d613b57d80ab0fbdb7cc3dc6fa46352d9d3e63d6f0bc8ddf8b2873
  • Size 45KB
  • SHA256 3aa671f079d613b57d80ab0fbdb7cc3dc6fa46352d9d3e63d6f0bc8ddf8b2873
  • MD5 ae92575ac9d57bd642aa63f425abafc2
  • SHA1 193efbfae94ecc0dcf34728340767e0013371c64
  • SHA512 c42bb600d2c79c3155c725681c9a42b6a87cb0aa456dff2ce9c363d7dc5a1eed13577cf71c9d19e7570b3901a0f8d149537c6d91869c7601d836274dad89d378
  • SSDEEP 768:cuqb5TrIGuCWUoKXMmo2qQUhk6K7OOPIzzjbGgt3iZTPJ/cwHk+x7BDZUx:cuqb5TrhG2g6VO3z3bZtSZ1cMxtdUx
  • TLSH
    T10C232B003BE88127F2BE4F789DF26145867AF6B33603D58A1CC4519B5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2