Extracted

• • Target
    3d8205c892f4dda185d3788676b1d9fe8f9868cc6dd144f61fb0da53d211aec2
  • Size 45KB
  • SHA256 3d8205c892f4dda185d3788676b1d9fe8f9868cc6dd144f61fb0da53d211aec2
  • MD5 d2f37e95b322d1d33d4482eab63e00c0
  • SHA1 f510c59b4438cce0f2b1e0c7ece10bceab6622dd
  • SHA512 b806811a989dfe6b532835db17d02fd19388a79496ff406db889113686d9f5f44d5d130a7cbec365d184695bf2cbbb95e81db179ce0d59349fec1d6a7ca59bc8
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1sg0ewWhchebLGPIYzjbsgX3iDUkkmYMGECprhBDZUx:cuR0JTPjY2lSwQpLvY3bjXSIk7LGldUx
  • TLSH
    T128231A0037E9812BF6BE4F78A9F26245467AF6733603D6491CC451DB1A13FC68A436FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2