Extracted

• • Target
    3663e284424435f86e9994c0393b608e9bfef5dcc76587ac486091415a182778
  • Size 45KB
  • SHA256 3663e284424435f86e9994c0393b608e9bfef5dcc76587ac486091415a182778
  • MD5 3ae897dfe1de7fa1bf8ecaf57ecf3b5a
  • SHA1 3540b2f29516a6c1522d5a126429b4e060399e52
  • SHA512 f28548437d4c254b3d82d8aef6366833e9d6f4290e041db703c78bf4eaf129556cda321fb15705d03c987f1d2ca68f1c840e41036ec22e3a5231123ccd814ca7
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVCT2QAm7PI1kjb5gX3iDMpRIpZBdm3GLdBDZkx:suJdpTPdI2+T1kbWXS8RInBdm3Izdkx
  • TLSH
    T1D8232B003BE8813BF2BE4B78ACF26145467AF5636603D54E2CC4519B5623FC6DA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2