Extracted

• • Target
    3ebe039b2977d7082fc0698ea110e091fd553c9a9a1423e45497208ccd2839cc
  • Size 45KB
  • SHA256 3ebe039b2977d7082fc0698ea110e091fd553c9a9a1423e45497208ccd2839cc
  • MD5 454982f2d6e84d49884b67722f2cd343
  • SHA1 4bdf02d091905ad6d0e181012a5782b845b75bd3
  • SHA512 366d6dc4b1a19abc482061be3f3249f4776358cb1c2ab3cb0c535551dfa9ae645b3e474d498dcbeaa7490771950f5e774d03e014f8f225bdb5434683b8d5e70a
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9TZo3TMtPIm7jb6gX3iZhLwfBDZsx:EulCJTHl42sU3mvbtXSfEpdsx
  • TLSH
    T1A5232B0037E8C12BF2BE4F7899F26145867AF6633603D58E2CC451DB5613BC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2