Extracted

• • Target
    3a5ad3881b105ad47d3980866fd4d4e9b64e802390fbc9288253c2516c642b89
  • Size 45KB
  • SHA256 3a5ad3881b105ad47d3980866fd4d4e9b64e802390fbc9288253c2516c642b89
  • MD5 df2065656c43c2c7a723c67e7fd03e65
  • SHA1 54005bd376441816829e8af63cd29fa6cb5bc395
  • SHA512 94bf1c04120bb48a072f10d7104d7785de4d84c8acf3f2c62b00c57ffd92433acb3ac7313e0bbde36b8eeddaa4ca2a5f2698b749ea069ec484f392d97a695839
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4IozHy3CKPI2vjbcgX3iPbCZLqIQ/oZ9qzhBDZ0x:8uUIpT4vAj2xrR2bbzXSuZOIIkcfd0x
  • TLSH
    T15C232C003BE9C13BF2BE4B785DF26145867AB6633603D6891CC4119B5713FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2