Extracted

• • Target
    3f963cce3bd5bfc0e86b9b6b869df4b174eda93f5064d33432d316deb17e3c12
  • Size 45KB
  • SHA256 3f963cce3bd5bfc0e86b9b6b869df4b174eda93f5064d33432d316deb17e3c12
  • MD5 627d0f9d8fa2a24e68a4124de21b628c
  • SHA1 af8ad7baf1c1cfe23bada7d8fcf26edbc01cb796
  • SHA512 538d3d3602c0183baa3d023d0be579e4b605516c364fa957b172ead13a377be5e12dfcad737b41880311cd4deb14c415388b3df1c8b63945fa19a205d71a084e
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNVcQSCBznqNLPI7zjbzgX3iqzHzhNlSaHPm7sBDZ2:5uSy6pTpoo2Ec9UqC73bsXSqzHNSqPhU
  • TLSH
    T1EA231B003BE9822BF2BE4F78A9F26105867AF2636603E5492CC451DB5713FC6D6426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2