Extracted

• • Target
    3c611bbdc3eb3ebce3ba712625645d085a6bc94f5c81936281b5dae17e9ff2ee
  • Size 45KB
  • SHA256 3c611bbdc3eb3ebce3ba712625645d085a6bc94f5c81936281b5dae17e9ff2ee
  • MD5 ded42f15bf8dd865621cb06a3ef58a0f
  • SHA1 b8ab1ce83ddf9a0b75a0f13110c0ac56dea68def
  • SHA512 7e0c531b86567110fe3f49883e89120891865ff1eeae6b3f42993ec690816925b540afe97dcc6c8c338a1ee8b1f2574aa5e6d3a2a7384662adeeb4444707d399
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1/Bz3QKx7PIaJjbegX3i75dqijhrdPuQmBDZUx:cu6YepTPso2+V0apbhXS75dbhpProdUx
  • TLSH
    T110231A003BE9822BF1BE5F78A8F26145867AF5633603D54E2CC411975623FC6DA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2