Extracted

• • Target
    d3f8acd481a0f34c0340ed50bbe065d2e0f484c1d241456b639196dddd241158
  • Size 45KB
  • SHA256 d3f8acd481a0f34c0340ed50bbe065d2e0f484c1d241456b639196dddd241158
  • MD5 dd39c10d2197e757f77594904ff388d7
  • SHA1 07e107a1913233904dc03893261f2fdd1a4a5f3b
  • SHA512 1d99e28593e87c39729ef2b25a2ec08f7f16a8e6cef3160b452c7481a246ef5e29824b2b60a547f55f38414ec90dde2db3965b73b871f49b7a1faaf21589b2b4
  • SSDEEP 768:ruKQpTA8RXNWU5xFrmo2qrE10CnMQRPnp8PI77jbegX3igu4eKsCABDZ0x:ruKQpTAOX2Htnb7B7vbhXSgpeKdWd0x
  • TLSH
    T108231A003BE9812BF6BE4F7469F26145867AF6632603D5491C8451DB5B23FC68A036FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2