Extracted

• • Target
    3582752196ca5e7ae1f98162489f19b20792a5c34fb3d8d30a4f68076d979e07
  • Size 45KB
  • SHA256 3582752196ca5e7ae1f98162489f19b20792a5c34fb3d8d30a4f68076d979e07
  • MD5 1f4a984835728c43fe4ec4d66e9e1a0d
  • SHA1 f7000de1af290e7fff8dc8f0d981214f6efc29ec
  • SHA512 5e71d0f4b81f3d0d1629609726970915e1783d342f5f8010ef9b2ed2107c6b59551c236753facb38bc1ec0da7d4575915f1bc6dafca55e6e3a1919fdbc8f0ebb
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFw3HO4SNMOPI0azjb3gG3idwpvKc2RBDZEx:MuLAZTnbg2R+JM30a3bQGSdwpj2vdEx
  • TLSH
    T153231B003BE8812BF2BE4FB498F26145467AF6773603D54E1CC452D74B13BC69A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2