Extracted

• • Target
    3419c7e1290d26e70e887b4f51c0b4e651c4fee63afad6d077af9437b2585b2d
  • Size 45KB
  • SHA256 3419c7e1290d26e70e887b4f51c0b4e651c4fee63afad6d077af9437b2585b2d
  • MD5 7eb2b7e7bb06d7367ed5ad7fa9931eff
  • SHA1 db0b9c5cb04acc51e5ea06ec0cf1e7c356f8fc59
  • SHA512 35baa7fd1c319dfb7a75221365fc34f6c8aa46ff8a511380cce268b8ab1775975d30ff1a26a198e6011d0f61a8f6cba2d1d528f300c2bc00935a2e7df13fa165
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAaLiE0yFjrdjYkk8PIurjbKgX3i2vsfmPlMrE5s40B8:kuSOpTPOP2KLBXQBu/bdXS2vsSwE5sT8
  • TLSH
    T144231C0037E98127F2BE4F7859F26145867AF6732503D64E1CC451DB5B23BC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2