Extracted

• • Target
    e3745881c75e0386fcc03b7732be3c5fdaf9b2948fa597334892b25d6972975b
  • Size 45KB
  • SHA256 e3745881c75e0386fcc03b7732be3c5fdaf9b2948fa597334892b25d6972975b
  • MD5 7b1594579ba551ef2039b50a0f38b96d
  • SHA1 a8db5bf2f3a1c3244ee344e718ef2e4f9180ba86
  • SHA512 737b5184a30d45ff0c2ad82b35bceb08912134f519532a478b39a44652003815d23f7490df91dcec92f7682d2f5f60144fb5807d7ca9beab965a9c17e3e98182
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFV3HE4eVoOPIGjzjb5gQ3i/cki0Z3xhQ38oF6BDZUx:cu7e5TH2A2EU1o3Gj3bWQS/cFqHQ38o9
  • TLSH
    T1B8232B003BE8822BF27E4F789CF261454A7AF6637603D54A1CC452DB5613FC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2