Extracted

• • Target
    3d29984c7ad4387a346241c5392d74bd42fa43406ae8fe1a8938942573bb2b5c
  • Size 45KB
  • SHA256 3d29984c7ad4387a346241c5392d74bd42fa43406ae8fe1a8938942573bb2b5c
  • MD5 d50d33662a2a87e5ea418eb5861672ad
  • SHA1 87c56c1be423e5d143f8a1e5f7d711043a7d655d
  • SHA512 50ca96a1df7613a64ed162d78347ed36dabf731b38c9fd2a5f83360224bb5c751e0da9890d4360f70fbf81133d8f9fa5d209a374596fe02af56cee036271a7ae
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9ICXtTt/PI2zjb1gX3ihiUcTgL7NBDZsx:EulCJTHl42fwu23bSXShiUc8/Ddsx
  • TLSH
    T100231B0037E9C12BE2BE4F78A8F26145867AF6773603D6492C8451DB5713FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2