Extracted

• • Target
    3c26ec9fe6b9416ec65a9c3154751663a28f6b92d69cf6eec3bf48eda7ce52c6
  • Size 45KB
  • SHA256 3c26ec9fe6b9416ec65a9c3154751663a28f6b92d69cf6eec3bf48eda7ce52c6
  • MD5 5339570ec4bd18a6166d52d18c94b087
  • SHA1 ac1fcdb0c6bda0ab404b0b65cf48be1662e1a1db
  • SHA512 4d5ffc3307afb4eb9c5cfb0a2133814e396e902e472c3bb09e6331f22ff4af405cbf7a6c333cb035663fb4f36fa089c22ab2eb9d15923eab3c67d53e15df0b8b
  • SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7EHO9YjoHPICYzjbUgX3iVmlh2rTgeNzDRP89QUbf:0ushJTDXgH2a6kgCY3b7XS4aTdRP86U7
  • TLSH
    T1CE232A003BE9812BF2BF4F7899F26145867AF6632603E54D1CC451DB5613FC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2