Extracted

• • Target
    3f75ac5ef1dc1487936d8c2f07b60bbf2b7c7b51198846f4fe9f0cd43c1fb700
  • Size 45KB
  • SHA256 3f75ac5ef1dc1487936d8c2f07b60bbf2b7c7b51198846f4fe9f0cd43c1fb700
  • MD5 7c9bba575634cadb520f1a28736d331c
  • SHA1 495f78d1c26520d7e713c877e0b0cf0f1779d9f5
  • SHA512 30aad7e3f799c069ae043f373ce0f9070416008c052417eaf6b1647a087fd3ded10d2e64bc9cf165c75576ad38841ef2a011a24e079e98826708a3f6fe6034be
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNfQ6vincPI9Tjb4gX3iRxlmH7CFnQBDZ0x:5uSy6pTpoo2pKU9XbvXSRxoH7knGd0x
  • TLSH
    T1A9231A003BE9C12BF2BE5F78ADF26145467AE2633A03D6491CC411D75723FC68A526FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2