Extracted

• • Target
    a3ffaae27979cf728184bac6d09bd9ee0fc7a7698303642506253384d87c2e8d
  • Size 45KB
  • SHA256 a3ffaae27979cf728184bac6d09bd9ee0fc7a7698303642506253384d87c2e8d
  • MD5 6e8a6303926cb7da4426f14cf37b7bfa
  • SHA1 b3695b29d6ea9dab0856aa09a14cb38aac26af65
  • SHA512 e0344738f6b93a2f41010927fd791c82ff34062b82182f99fe01f4c8a4ed8587e2390d4cbbf8ee2a2e44b6302c923732ad2c4fd5b99e2305efb9c550812cc0f7
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4Q9oyvinPPIQIjbfgX3iGdgho8dNBWaZ/BDZ0x:8uUIpT4vAj2saCdQgboXSGIBWaHd0x
  • TLSH
    T182233C103BE8C12BF2BE5F7899F26145467AF6633A03D5891CC451DB1723BC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2