Extracted

• • Target
    3c51a775b4f08c7b2b0e9b1b9afdb342f798faf912424c0d6a506355e578b586
  • Size 45KB
  • SHA256 3c51a775b4f08c7b2b0e9b1b9afdb342f798faf912424c0d6a506355e578b586
  • MD5 f54e335b965eedc160d2683986749546
  • SHA1 569f623828bc49203934af76fb19c950d6331153
  • SHA512 39d0ad42b5f073436dfd735c8a1436251136d11db43740001b951c29dd58189eef2c9d0a91ff25f1fec74053ffc0a5612feb5d2c24a394fa251c980ab8ba1fe0
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtkZo3TMtPImqjbtgX3ijehFEKuRrTvk8iKBDZ0x:5udApTNmU2lU3mmb6XS0u9GUd0x
  • TLSH
    T154233C003BE8C12BF2BE4F74A8F26145867AF6677603D58E1CC4419B5623FC696426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2