Extracted

• • Target
    3c2ef6cab2b412e533876844e8868f7461f068a19ef12bd96e06ec842f58d221
  • Size 45KB
  • SHA256 3c2ef6cab2b412e533876844e8868f7461f068a19ef12bd96e06ec842f58d221
  • MD5 3d7928ae514ef72784aeced105cba1df
  • SHA1 27c4942db8faa543a98beb6432a89405821e0644
  • SHA512 a07b04fa3e3c5f3410be7ccabe4c26a1245a9e5232f1eaff0e5c2bf3774c716ef366779818f730e12c4197c3ec0209ecc0d38015f06468356a942a70edd2ee21
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9b9YikqHztOPIUzjbwg33i1cf4GiE5vtIBDZsx:EufspTf2g2WalK3U3b33S1i4GiOtudsx
  • TLSH
    T187232B003BE9C12BF2BE8F789DF26146857EB2672603D6491CC411DB5713BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2