Extracted

• • Target
    0c3e754437b1c39ae7fb492de2293f3c1279731df4ee7c56d5877837602c0db3
  • Size 45KB
  • SHA256 0c3e754437b1c39ae7fb492de2293f3c1279731df4ee7c56d5877837602c0db3
  • MD5 5e34403afacf612a65de0669baddada2
  • SHA1 f68b856840fb8550a1462efcceaa656a91f25868
  • SHA512 76ef0c920605b20f094c0e6426b2aed819885c0b054f562ce1d5e260087edac1aab1015c5998bfa0772d5b05812f959edbe977decb4293ed374acbc1339a2370
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVOT9Qpm9PIbzjbFgX3ik07fGJUS4Bd1EyBDZkx:suJdpTPdI2ZQb3bCXS57fac1EMdkx
  • TLSH
    T146232A003BE8C637F2BE4F7858F26145867AF6633603D64D2CC4519B5623FC68A526FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2