Extracted

• • Target
    3808962ba45b028b03ec68c07f0e485ba54296fe8e2cb95824d36376ca3590da
  • Size 45KB
  • SHA256 3808962ba45b028b03ec68c07f0e485ba54296fe8e2cb95824d36376ca3590da
  • MD5 50d3625a7b7fa1671850ab008a3aa022
  • SHA1 9de28d88f410a21eba3f3a2dbf0332d6139e369f
  • SHA512 1433ae7d68a3acf8eb6026c3bf04c44eb5bcaa765be81bdac03caf1e3c67395afc976943d3ba414277bd83f534ed00a874e9f6474ed41b860d3a2193c30ad682
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q95dR3aI6OPIuzjbPgU3iJZQnhP5a2QXG7BDZsx:EulCJTHl42mjqb3u3b4USJZKJk2QX0du
  • TLSH
    T10E231A003BE8822BF2BE4F78ACF26145867AF6673603D54E1CC4519B5613FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2