Extracted

• • Target
    3385285149591975f0db68f6b06bf32ff8b19426fe3a7530872fba0fdf2f72c3
  • Size 45KB
  • SHA256 3385285149591975f0db68f6b06bf32ff8b19426fe3a7530872fba0fdf2f72c3
  • MD5 df836cf81914a90e03a6555a03919dc0
  • SHA1 c58c837ee7dab652c18bd2a2088c9e1976e39acc
  • SHA512 52a7516007ecc6e7fa85a57248902e42616931e19cf937cee76616703b271ef9279c3aa7f2704c432c5fe46f9e2d7b03ae1d411af4c1abca3cefef27b0394670
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q98wD/y/aqPILzjbUgX3iUPkSoFTNYZpnBDZsx:EufspTf2g23khL3b7XSUPLCTuZDdsx
  • TLSH
    T1B3232B0037E9C12BF2BE4F789DF26145867AF6632A03D64E1CC4119B5713BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2