Extracted

• • Target
    a3d96fd98e2786f4853ec9ab5c180da9a049c6d2dd19a9b8fbdc14958e12b0af
  • Size 45KB
  • SHA256 a3d96fd98e2786f4853ec9ab5c180da9a049c6d2dd19a9b8fbdc14958e12b0af
  • MD5 2bdbb72841da90391b1e12d737b667e2
  • SHA1 7c714d298157b8f5f8f8533bf45ed996614bb847
  • SHA512 bf1c24a9de899cda57e72b765a18046b29b77deb845606d4e543b7a8e3b3c9dffb15de3586b63e3b820cf54a4a49fdec23ee89d3e77393d8ffc044467827042b
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAjT2QAm7PI1wjbLRgX3iyIh+bD7Vpyh8BDZcx:UuKWgSJTwRf2GT14bLeXSyBDRCadcx
  • TLSH
    T151232B003BE88237F2BE5FB86CF26145467BF5636603D9492CC4519B5623FC6CA426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2