Extracted

• • Target
    3209dc7066060d88237231bf93d0c98c2497d5d60514417f31843ac4bdc10d79
  • Size 45KB
  • SHA256 3209dc7066060d88237231bf93d0c98c2497d5d60514417f31843ac4bdc10d79
  • MD5 9cb507a768d3008091d37edc5000600d
  • SHA1 3d1250ecd55498507a20536a76f019f734d1d797
  • SHA512 ce8aae20f684baf04a3d0a86b3a2a2a50d0001fdf5e675f141bbe2873862ec4397a52b53ae9c27d2ec77d6452739f49de9267904e4161a9ccc82749159eed88d
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwfm/9GgROPI2zjbQgX3irOI+4d4Vr7TyGnBDZMx:ku40ZTXEb2Lm1h323bXXSrV+NVrTBdMx
  • TLSH
    T1F9232B003BE8822BF2BE4F7899F26105867AF6736603D54A1CC451DB5B13FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2