Extracted

• • Target
    c3683ab8ceec8b898544fc803e2ed711a6c9c487dd86ae907cbaf5e8cd067f1d
  • Size 45KB
  • SHA256 c3683ab8ceec8b898544fc803e2ed711a6c9c487dd86ae907cbaf5e8cd067f1d
  • MD5 e6062df003b13b336cdffc3787f14df9
  • SHA1 28e1e95ae826233ecac912514fa9c2d0ff1c4ee5
  • SHA512 86ab6f2ed5861043971150f265db0eabb3cc9aa56cb4d087656a6425a37c080717be28bc0a05dd7ff384c3ab4c1891f566783691b52abf423d2ef4a586b70592
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4UzjHy/aKPIb3jbQgX3iCasxvN3Ge/KNBDZ0x:8uUIpT4vAj2wnhbTbXXSCasZN3Gm8d0x
  • TLSH
    T1AC232C0037E9C22BF2BE4F7899F22145867AF6632A03D58D1CC451DB5713BC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2