Extracted

• • Target
    3a5d3a4d74ff51ad6d1e6ffbf23cfae81dcfe8a306c74554fb0cd3a4d5fa2663
  • Size 45KB
  • SHA256 3a5d3a4d74ff51ad6d1e6ffbf23cfae81dcfe8a306c74554fb0cd3a4d5fa2663
  • MD5 b00877af5db585124465f58e7e201971
  • SHA1 ffddaa244ce96a3c048ad9d86733be41b756985f
  • SHA512 23d96181924b5ab9eeb3e439d8a0e7d59f95c1aaed3bda11f7a54333ad5c83946569e5634d7c2b99d5931bd93f086c9062541415b8f7d2a7085322d46a5b9c09
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9oozfy3CKPI0qjbfgX3iMPq/A65pNf++7jBDZsx:EufspTf2g20TR0mboXStA65jHldsx
  • TLSH
    T161232C003BE9C12BF2BE4F789DF26145867AF6632603D54A1CC4119B5723FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2