Extracted

• • Target
    3efe8db24bee1a77b952c7cf111a4f270bb6da415345913fcaea65f042985f53
  • Size 45KB
  • SHA256 3efe8db24bee1a77b952c7cf111a4f270bb6da415345913fcaea65f042985f53
  • MD5 e1d4b220f850182f352430aba8752a36
  • SHA1 502f323e1a51c9557315c667cb84e98ba2e88820
  • SHA512 771fd0016a776a2123241edd9bdb2f3546ac99cdfc1c7f9143602dd0ef897459258941503dced01929def04e78a5bf79c925910fa9af972d435de4d9f3f0e76c
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlQZTohEaSPIxzjbqgX3iJuvFA25kzZnI86BDZMx:wuDWZTpMZSB2N4Ea7x3b9XS0V5kCdMx
  • TLSH
    T1E9231A003BE88227F2BE4F78ADF26105897AF5736603D5491CC452DB5713FC69A42AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2