Extracted

• • Target
    3d254e2c9d9cf95e53e3012a7e9b41fc2019cc4aeb8ba9ac9acf10b2c4c6276a
  • Size 45KB
  • SHA256 3d254e2c9d9cf95e53e3012a7e9b41fc2019cc4aeb8ba9ac9acf10b2c4c6276a
  • MD5 c1de3950f326ed95d49d227aa1ea6fd8
  • SHA1 33d1a7a9fe6b8aabba781117a873adaaa74bb136
  • SHA512 ec440466d56e5f6a4ef108603bbbe46b000cae05f64a81d2cb3d840b1a9ec7bacf67b135508b105acfbc2aa1380e6f357eecf3af0a98168bb45f9e9a5fcfadcc
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1f0eUNEARViZPI6zjbcgf3iwfmqy+TNDFDLJBDZUx:cuR0JTPjY2mUe+iW63bzfSrqy+TjdUx
  • TLSH
    T17C233B003BE9812BF2BE4F7859F26145867AF6633A03D6491CC451DB1713FC69A43AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2