Extracted

• • Target
    3be58fa38ee4d6852a5b94f7b529ffc64e7a49ea0920fe9bd4cf0510bf97475a
  • Size 45KB
  • SHA256 3be58fa38ee4d6852a5b94f7b529ffc64e7a49ea0920fe9bd4cf0510bf97475a
  • MD5 174658a1f9b69b09fad0a016589899fa
  • SHA1 3ca54d6145e9dc6cf5f9f9af5b28e7f12b82bd2e
  • SHA512 ea7c26b3ebc16d3c015d527d72f4b3022b0e4bbcc24bed1d60a1b333b426fa49f2a7b7fe013812a73f05ee12f121bbc918646ecef72794837055c39e33a92027
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAW0ewtDc30oiZPI/zjb4gX3ijmCJebgXccYBDZMx:kuSOpTPOP24wR2iW/3bvXSHJJX8dMx
  • TLSH
    T153232A0037E9812BF27E5F7869F22245867AF6633603D6491CC441DB5B23FC69A436EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2