Extracted

• • Target
    3cd7643c8856399c6fa4dd87f65351b5f9dd5661c533eb21f7d6c7cf1a1d9c1f
  • Size 45KB
  • SHA256 3cd7643c8856399c6fa4dd87f65351b5f9dd5661c533eb21f7d6c7cf1a1d9c1f
  • MD5 1e6d3600e75fa8981f6db86939c9c4a3
  • SHA1 21cffa9551defe47a9d8c2c27f36e12ec8f8b268
  • SHA512 9672ac74a59c88300c4162eb41ca2045ed2dc82b383412f27eaa313e2f0d3a970bc0d99f2863a975d117d9c9d4212254e039dd8e38382d212af343089cad3e39
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9zCOtTMtPIczjbGgX3iLh25TubDJ1s/c9Ko8BDZsx:EulCJTHl42MRvc3bZXSLh51s/kSdsx
  • TLSH
    T103232B003BE8C13BF2BE5B7899F26145867AF2633603D58D1CC441DB5623BC69A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2