Extracted

• • Target
    3c842d813c5616e81838fe090806fedb13a0156e69f873f5cd11e53de9c51a38
  • Size 45KB
  • SHA256 3c842d813c5616e81838fe090806fedb13a0156e69f873f5cd11e53de9c51a38
  • MD5 1989cd7fc51039a1a35ee1b40e309375
  • SHA1 451633b858499b99fddc4f884f10cf375f0b8dd6
  • SHA512 97b2408d77caa05a6d6c3edfa73d58ce201f957d5d7d5ab0d81ad9befcf73f7b3fb0c1a37f68462a82d3bcedbca29ae7f26d07ccc0d08e42fb8ab87cd48281aa
  • SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qjMITnyHaaPIHzjbZgX3iT0MlMYwvVpS/uBDZ8x:0u2vpTDe+2FE5H3b2XSQMl5wbS/gd8x
  • TLSH
    T152232A003BE9C12BF2BE4F789DF26145867AF6633603D6891CC411DB1613BC69A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2