Extracted

• • Target
    3d09e67590084b2fd51e93128d1f55041d23587abaa54d1ee16458adc6d3ade7
  • Size 45KB
  • SHA256 3d09e67590084b2fd51e93128d1f55041d23587abaa54d1ee16458adc6d3ade7
  • MD5 7b2b27f916c9073bcf05e725ae07db21
  • SHA1 384899bc379bb49d6c8686e27dde4d4db09ccbcf
  • SHA512 c062d16f7d5f8bb5bb89404c8914aeffd26c5ad36b680b1c2473ab64047125df5c74cc380f1e24944dd84d35c429e4cbbed7ac0240055037345acdb070fd3893
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFOeeXK5o5TN8/nPI6EzjbxgX3iYmiRN+fu22DBDZEx:MuLAZTnbg2aeEoTNKA6E3b+XSYjyfu2Z
  • TLSH
    T165233B003BE8812BF2BE4F7899F26145867AF2637603D59A1CC451DB5723FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2