Extracted

• • Target
    3fff5db27f44c707e8820dd109f896cfff12aaee289cc893326605b24157de79
  • Size 45KB
  • SHA256 3fff5db27f44c707e8820dd109f896cfff12aaee289cc893326605b24157de79
  • MD5 11fc101a1e4f4b9534deacf981d317a7
  • SHA1 5723126b4c935b2eca9b5e27146911d3cf689253
  • SHA512 5d705ed649a92b64791953103b79e1c20ffcd2fcd777f753b67fb0eb6591df1d9a5f7ff36b35276b9e1acf5753ce0ac6ac53036cc1b1617a719724322a56a1b5
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYfDEbHBqj2OPI/pzjbIgX3iCYmxo0CFL0V++04HnQBU:8uuSpTgyf23yoK3/p3bfXSCYmxovFb+T
  • TLSH
    T16C231A003BE8C22BF27E5FB8ACF26145867AF6633603D5491CC4529B5613FC58A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2