Extracted

• • Target
    f3d596585f8893fc35c12a0f36f51214e0c70443aa93ae2bc3beefd84ac575dc
  • Size 45KB
  • SHA256 f3d596585f8893fc35c12a0f36f51214e0c70443aa93ae2bc3beefd84ac575dc
  • MD5 f01f025c63141007d57e60b1afd3ca52
  • SHA1 b1ab9c8453efe74be55ab4fd65b11bdd99449d8a
  • SHA512 70fd8f029efc22ba277da208422c595d23b030f13d246f04e828fbc12c104a6933b967a4274e311be73b380749efb395099be8f70abdd86dfd78859770885b02
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1fL5P02FUFd8Ykk8PIRzjbwgX3id2yssS25/jSenBDg:cuR0JTPjY2SLDmTBR3b3XSW2VS4dUx
  • TLSH
    T1C4232B003BE9812BF2BE4F7859F26145867AF6636603D64A1CC451DB5713FC68A03AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2