Extracted

• • Target
    3ae114f7db61ab9ffc933a51148cf3b14b70a26a851e6b550a00cece4257e4f4
  • Size 45KB
  • SHA256 3ae114f7db61ab9ffc933a51148cf3b14b70a26a851e6b550a00cece4257e4f4
  • MD5 aa7e41177b6e743fc42c40b96707a7bf
  • SHA1 1e4db99d4214a4abc7e67ef26968ef7a3ebd8516
  • SHA512 8dc6c7171a3861f7d833acee88b328f344f2a816ed460b242528676bc5477e1d4a9339ac0b0f5b391ea62a37d3db650a7c984e7c0357027e89cc8af64d05699e
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYlCSwTMSPI5Tjb2gX3inL71xVQol5JYsBDZ0x:8uuSpTgyf2dgG5XbpXSnL7pflzYqd0x
  • TLSH
    T1DA232B003BE9812BF2BE4B78A9F26145867AF5673603D58D2CC4419B1723FC58A427FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2