Extracted

• • Target
    3d98c5e90e13be562fc8ca1af47a266aba95b40c7257413d1bb8eb556573c234
  • Size 45KB
  • SHA256 3d98c5e90e13be562fc8ca1af47a266aba95b40c7257413d1bb8eb556573c234
  • MD5 a81ab9cbd761ae6376f34fc4347f089e
  • SHA1 74578ecbac8ddaa161e34096aad3ee124a297dd7
  • SHA512 0962015ad2b255e647b355c003205a551704c519f9b7b277dee0f55d68af1c7e28ba0421b41e16c06872c487754ccb66026b83d73e931648919db9b3df5af87d
  • SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qrrb3/GYjHuPInzjbtgXKiaQLyf7mQG+BDZkx:vuogpT7I62gL/3n3b6Xz92TmOdkx
  • TLSH
    T12E233B003BE9C127F2BE4FB898F26146467AF6636603D64D2CC452DB5613FC29A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2