Extracted

• • Target
    3d68ab06b2f673521279f38c988ee28f11f7a70cb25475659804061aa406f1d5
  • Size 45KB
  • SHA256 3d68ab06b2f673521279f38c988ee28f11f7a70cb25475659804061aa406f1d5
  • MD5 dd918851a15e64abce8480c39f388939
  • SHA1 f3cd36792cfe5fb4f49ea19c55de2742394140ad
  • SHA512 08aae6db6911cf0de548602cbc62ea3ef4437c63d26354a55e4feaf693fde7051b450d9acb1bc85bd129e58dca6eb08c370692c9a9c6b8fd358e864b25f77417
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1n+GtCVnJtHuPI+zjbMgX3iNC7kPMUez0lDBDZUx:cu6YepTPso2M+TB3+3bDXS47+tlFdUx
  • TLSH
    T168232A003BE9812BF2BE5FB898F26145867EF5633603DA4D2CC441DB5623FC696426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2