Extracted

• • Target
    d3e2813f692650201f392c52774e6a74535dfb83d0f9d4b5eb8ef97b2d58fee9
  • Size 45KB
  • SHA256 d3e2813f692650201f392c52774e6a74535dfb83d0f9d4b5eb8ef97b2d58fee9
  • MD5 a946bc7cb1e86b41d2e0d07495984f3e
  • SHA1 8ad8f66f8dc3c212b2df8f50296e593adf7e2954
  • SHA512 2aea3ce5e812d64804e9f3a071bd9e38abb352d828c22797250a6e554f5beccc176e3da2f0bf1d1b7fa17c4612b3e9a384c217b9838a8a6eec0b9a1bcb1818c1
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1iBzvQjx7PIrNjbigX3iA5Nd8AwcTfGRLkBDZUx:cu6YepTPso2L1VrFbFXSA538A5zG9SdW
  • TLSH
    T1012309003BE9823BF2BE4FB898F26145867AF5632603D54D6CC451DB5623FC6CA426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2