Extracted

• • Target
    3eef1876c4ffe51d6ec2b5a6d0ce015ee96c2c62f874489b9fcc500cb60061ff
  • Size 45KB
  • SHA256 3eef1876c4ffe51d6ec2b5a6d0ce015ee96c2c62f874489b9fcc500cb60061ff
  • MD5 b1da6c9c87780e7daa9115501642b4ce
  • SHA1 5649186b3d92edb8a73a2beca2a7d046886f3fd6
  • SHA512 d723ea7b852bfe9b51c457d6c31f78e920efaf79fa52b4871527613cd6b3487f53b7d27727f9e3c76560cdb1df8d08242e9e671e0941cba99269a7e4b818b147
  • SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7sZoQTMtPI4EjbnRgX3ioO1jwyzncuWgBDZ8x:0ushJTDXgH2vL34EbeXS/jHzc+d8x
  • TLSH
    T182231B0037E8812BF2BE4F78A9F26145867AF6673A03D54E1CC4419B5623FC68A536FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2