Extracted

• • Target
    3f219456535da01a324c8cad24aceef1b3d3d30d3dd1700e1090d2d24d5e4e37
  • Size 45KB
  • SHA256 3f219456535da01a324c8cad24aceef1b3d3d30d3dd1700e1090d2d24d5e4e37
  • MD5 11d433e4eaa991ade048680f2acbdcab
  • SHA1 4a5765205793733f1b263c62b6ddf05cf8f56b30
  • SHA512 d3e0c65c63b4d5a07b56719120ba125a2acec48958c29c92471ef4c36aca4b4889232eff7a4f063d3505ef0eb15d58808451b6d2fa14d004ea968938bbcf90e9
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4D9wScq/z1OPIszjbtgg3i+EEiPkNpMhMfpBDZ0x:8uUIpT4vAj2Hi9K3s3b6gS++PkNpMh+U
  • TLSH
    T1292319003BE8C12BF2BE4F7899F26145867AF2633603D54A1CC452D75713BC69A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2