Extracted

• • Target
    3aa279be2c26c6b6b09728e4497c98d925d808603d6fc085da385077bd027373
  • Size 45KB
  • SHA256 3aa279be2c26c6b6b09728e4497c98d925d808603d6fc085da385077bd027373
  • MD5 c109794d7aef0965e6aa208f0e5cd361
  • SHA1 4139ed255e54734fd737326844e660747b41c40f
  • SHA512 3ea4956198a32e01d78c56c72191f46547f1c6cf6522ccf2bbad55b3ec8df685c91efd07e5fd2a3a8cd2d77ddc971fb63da12f22025530df37db5e8fa73541e0
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9zx1HJhOPIcozjbTgFU3iVnL8r3p/JmBDZ8x:0u1YJTHcw2EFj3co3bMFUSVL8rZad8x
  • TLSH
    T1B5231A0037E8822BF2BE4F78A8F26145867AF6633603D5491CC451DB5A13FC69A52AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2