Extracted

• • Target
    3d87ec65c981128daea170d7be2a11d9420a7d493a14ed9fff021107985539c9
  • Size 45KB
  • SHA256 3d87ec65c981128daea170d7be2a11d9420a7d493a14ed9fff021107985539c9
  • MD5 6d475dca9915cd46d9e51860de872fac
  • SHA1 3662e01a33dbeaea8fc49aa762fc31f77f9f5167
  • SHA512 90ab8e30dd88293db43fddeff53a057613bdc0a1688ff0d9aadc6c4328b5bfe413b2c4e4c11e2d1776a70b7756dac9ad4f2dbbfd945c6131be8829beb061f431
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q16T2QAm7PI1ajb3gX3i6+J/5ummNO64s2BDZcx:RuxkJTgip2mT12bQXSj/umAWsYdcx
  • TLSH
    T10E232C003BE8813BF2BE5F78A8F26145867AF6732603D54D6CC451D75A23FC68A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2