Extracted

• • Target
    3dd3f07f9ecdee159ed453dae63b33561adc5cc05c0558d57cd09cc7989421c7
  • Size 45KB
  • SHA256 3dd3f07f9ecdee159ed453dae63b33561adc5cc05c0558d57cd09cc7989421c7
  • MD5 a3f6a21a727dadb37fe06c71d10e89f2
  • SHA1 a54b7fde20c0cc4f80502c42aa70997e104f72d7
  • SHA512 22497ded41c7d8402240d40e715310f663d02029b0a0d879795ba25f0f4eb51457bd3bd6b3de21593cf2183a500b5258194e1520d520a474ae84a9007eed80f5
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qF1Nd3u40cMOPI04zjbEgX7iwe719kKPeby7BDZEx:MuLAZTnbg2m8+M3043bLXWt91IytdEx
  • TLSH
    T188232A003BE8C12BF2BE9F78ADF26145867AF2636603D54A1CC4519B4713FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2