Extracted

• • Target
    3f02fe26eee3a7741ca9285659daaa496a720d59ed12cebdca42562aad3c10db
  • Size 45KB
  • SHA256 3f02fe26eee3a7741ca9285659daaa496a720d59ed12cebdca42562aad3c10db
  • MD5 a7b9cd1de0d26d95e32956cfefbc6225
  • SHA1 f4fe19e76e9629019644beb649e91c0b00c81e04
  • SHA512 44538587722ffeb261a222f85f5286977289be12c6a205f75f66af74a7c9cf3dd4f43cd5a96bd26172fdc2387752c36d02be07fbf1cf4f8f04e041804c6bc505
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFENd3u40cMOPI04zjblgXmi72XOxIjIXnW5ZpQ8BDg:cu7e5TH2A2T8+M3043biXPSBwspldUx
  • TLSH
    T1A2232B003BE8812BF2BF4F78A9F26245867AF6633503D54E2CC451DB5613BC696426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2