Extracted

• • Target
    3331443dc0b7073f448889ef6f6e253aa2216cccdd2ad980662c6c3a12fcfa83
  • Size 45KB
  • SHA256 3331443dc0b7073f448889ef6f6e253aa2216cccdd2ad980662c6c3a12fcfa83
  • MD5 5fd14dca6b0045b81db7c3d3769278d6
  • SHA1 488b2eb6fa4076a1539e93ff1d574e32a189d8a9
  • SHA512 a6597caaffccfc5b4cdb72f7c8ce3ea258a4859b32bd3e23247c176a9700c7aada028a770e203ac01ec29f0763e86dbf2331ce65d5486bfa5dc7fbae5bb54795
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNrzjHy/aKPIbfjbAgX3ixujCtTZ1n8IBDZ0x:5uSy6pTpoo2onhbrbnXSs6Z1nzd0x
  • TLSH
    T106232B0037E9C12BF2BE5F7499F26105867EF5632A03D6891CC412DA5713FC68A52AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2