Extracted

• • Target
    41f3a32c2a08167c1f53f3def6751f11f346b7508d7ba2c88c73462b4f3a06bc
  • Size 45KB
  • SHA256 41f3a32c2a08167c1f53f3def6751f11f346b7508d7ba2c88c73462b4f3a06bc
  • MD5 e12224a332552374bc048506366e96ec
  • SHA1 bebb11e6bc03c963029f31e4cf3dae93a4c74b7f
  • SHA512 bfdb657bc0e8d89b2891f8f904352092298d665ab94cef9f2a38229eb0ba9f82179e85eddacd8a93432bcd716e2ce6a7306260548e4e05abfe7d094e76929199
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVNHUttXAPIMzjb5gX3TCsN4Hb6pBDZkx:suJdpTPdI2U0rXlM3bWXDCsr3dkx
  • TLSH
    T147234C003BE9C12BF2BE4F7898F26145467AF6637603D64E1CC452DB5623BC28652AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2