Extracted

• • Target
    e3a8b4beb87877cf6cfcc9af5565af8741f4e97065b2feb5fa4507e32ddb4982
  • Size 45KB
  • SHA256 e3a8b4beb87877cf6cfcc9af5565af8741f4e97065b2feb5fa4507e32ddb4982
  • MD5 64f0e352b49b16527556661d90db6a7c
  • SHA1 cfaa3309039298852533a17278ba022353d812f1
  • SHA512 7a4b1661dbd6269530b7ef96c1819962d6b9a9ed96a429e808d4545998821061b695e9356d4e53992f8bfd44f275e337a91f11851b1eb98ad201a31e8761d373
  • SSDEEP 768:VuBfJTMUyYUWUWBDimo2qVPsD/pneqPIkzjbVgX3iD1LgxexnX3MGBDZXx:VuBfJTMpv2UsjJeTk3byXSDG23MIdXx
  • TLSH
    T166232B003BE8862BF2BE4F78ADF26145467AF2632603D5492CC452D75713FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2