Extracted

• • Target
    3f484a15eecd22b08a096c1affd536b881c40a1bb1fb3b87697a38fadf795e56
  • Size 45KB
  • SHA256 3f484a15eecd22b08a096c1affd536b881c40a1bb1fb3b87697a38fadf795e56
  • MD5 9d272e70b468753d671cc461a1ce33a6
  • SHA1 0057db4d588e5b058f6a1f7294144a50cdc55063
  • SHA512 d705cef04550fe6ccc1fdccaa91ec91fb57fff60f9d382d28bd33f06292003f6b87649961c4d24df1450a519a2a7b5132dd5e4194337ea36fa5702f713e3c419
  • SSDEEP 768:Iu5KkpTsU6Q8WU+xjamo2q1fmaPol53APIkzjbcgX3icCJ0ALnGerqBDZLx:Iu5KkpTsx/2ufob3lk3bzXScCJ0AyU0P
  • TLSH
    T195233A003BE9813BF2BE4B78A9F26145467AF1637603D64A1CC452DB4723FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2