Extracted

• • Target
    3f598c98e0552e110ad8b81922adc3b097148f794c5617790d1edc94793c4676
  • Size 45KB
  • SHA256 3f598c98e0552e110ad8b81922adc3b097148f794c5617790d1edc94793c4676
  • MD5 ea6736cd1cad5ffec560cb4cff6087da
  • SHA1 3810c6bb19a29a107f0fb7143697189476498158
  • SHA512 aff6659c14828922447f614ea8a512cc472aa4d8d5d907cd813c56318a128d9aac2b573e17196c6279597a8d3d1abf2890b6ccdbcabf49f7f29a02bc057ed0c3
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVLVCop3UGcPIfzjbFgX3JF9xzlmlFBDZEx:MuBGJTPho2yVtRUGhf3bCX5PxzklLdEx
  • TLSH
    T1F3233B0037E8812BF2BE4F789CF26145867AF6637603E64A1CC451DB1613FC696926FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2