Extracted

• • Target
    3cd5b4d086424e222f159592f442352329ff22fb5d5122375b6f5b8ec5a5099d
  • Size 45KB
  • SHA256 3cd5b4d086424e222f159592f442352329ff22fb5d5122375b6f5b8ec5a5099d
  • MD5 ff24ed9c20cee8937ae048eabf548bb1
  • SHA1 1b0725a40bcfb08c52cf90b14a292b14fd944fe3
  • SHA512 5d6d6ca6173d0aaa744e04768be4140c49c468aa7da3c72e57f0f2e2d818967308db82c3a904299c58b5439fb20700004bf328716ae8d496fa95064ba589ff78
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9zx1HJhOPIcozjbCgh3i0c5dq1ratKmm+BDZ8x:0u1YJTHcw2EFj3co3blhS1dy2kmmQd8x
  • TLSH
    T19B232B0037E8822BF2BE4FB898F26145467EF6673603D58A1CC451DB5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2