Extracted

• • Target
    c3e181b03eb967b65c4bc6b6f56ec7c41df45921b18ba485d4b5655572786a98
  • Size 45KB
  • SHA256 c3e181b03eb967b65c4bc6b6f56ec7c41df45921b18ba485d4b5655572786a98
  • MD5 161dcb369aae36096550785133c29464
  • SHA1 2afd5d426efa6389b765d4fccb78e6c3f63cd4d8
  • SHA512 ef758086e12428fc7f0a7590a8459d734ca7b2e6f818db5bd8efb29a6dd5b4ad4ef1f4546f9513254914e0409d8689a2ccd1ac611a6d20088bfa234d36dba594
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFdm/9GgrOPIRzjbagX3ibXaItshzC28nTGBDZEx:MuLAZTnbg2um1b3R3bNXSbXaIteC2MEE
  • TLSH
    T189233B003BE8812BF2BE8FB8A8F26245867EF1676603D5491CC451D75723FC69A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2