Extracted

• • Target
    3e8851c8fd2d4836d4fcd84517408a955e58cf40289cce637110db4e20c197e5
  • Size 45KB
  • SHA256 3e8851c8fd2d4836d4fcd84517408a955e58cf40289cce637110db4e20c197e5
  • MD5 d24facfa77c47ceb32b2ad08c4cb153e
  • SHA1 720444a39683277c89ccc1a05af07cf412b4775a
  • SHA512 3f6af29dbe38a26fa241091f62a5568f0dc9743f2b8f686157db708e567539f288f1452194bea6e0b8307a8dab3751334ff0d20c95e55f2ace748dfb546a7da3
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1OBjusyQowsPIWzjbdgX3veYYeDY711BDZMx:wuZ8pT1tc2XBjuxZwRW3bKXfeVjRdMx
  • TLSH
    T1E0230A0037E8C12BF2BE5F78ACF26145867AF2636603D54D1CC451DB5623FC69A42AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2