Extracted

• • Target
    3fefbbd30ebeed30cd77cd4b21ba342bf02a63d72243a87ea32a4c0c576eedc4
  • Size 45KB
  • SHA256 3fefbbd30ebeed30cd77cd4b21ba342bf02a63d72243a87ea32a4c0c576eedc4
  • MD5 a595acbe8cb927d8c76adda7a1933ee5
  • SHA1 0d5f7a68e1127dd546e281ddb90f45ded7a35726
  • SHA512 f044b5f186b7c0f115c772dac4ec01e8c8c738b0b638c9d684452d4c536e6d9d6f081ff712bbbc258bda7dd42462e31737b818b7e8efd06b0c2fbb555dbb1047
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1fLiE0yFjrdjYkk8PIutjbggX3ijVZZMPA6ZzKRW9B0:cuR0JTPjY2SLBXQBulbHXSJn7y+RWTdW
  • TLSH
    T172231B003BE9812BF2BE4F7869F26145867AF6733603D64A1CC451DA5713FC68A436EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2