Extracted

• • Target
    3f632a14c50b7375d5705edc71632cfe2e9eb67d2375647c0e94a80f0b227c84
  • Size 45KB
  • SHA256 3f632a14c50b7375d5705edc71632cfe2e9eb67d2375647c0e94a80f0b227c84
  • MD5 0acfee67d21ca3b18fde2bc6fa598af7
  • SHA1 ed718a62f0c001f2c0ebe7d625b7170462da55ab
  • SHA512 0d1ce02141035f4819c1a1cd8635d535c759be48ca5da98acb4fa9caa064bc81c94f7686d2b5f4fc22695b766769d7268511417a355c490aae721f60fb9cac2c
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1eb3/GYjHuPInzjbfgX8iyiJffa5sbSBDZcx:RuxkJTgip2zL/3n3boX5yJsAdcx
  • TLSH
    T1CB232A003BE8C227F2BE4FB898F26145857AF6676602D54D1CC452DB5723FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2