Extracted

• • Target
    3c06eba21786feca13e3c9f070dbfd382a1da4293681b20b228fe9281ff60dcf
  • Size 45KB
  • SHA256 3c06eba21786feca13e3c9f070dbfd382a1da4293681b20b228fe9281ff60dcf
  • MD5 1407551561d186b2958319a7d3973413
  • SHA1 c2cf6ba30d10561cbfeb9405b2e9aeff47d59b0f
  • SHA512 fca2d567d59fa8451431a8a7fe007763033aee77323ac9f917481ee385aee5bd9d28826efb6ea79eda57f3adb366f6ce9d956ca81410c0c6da973c604f53611c
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlplsNoPEaMPIcDjbQgX3iPMx7PCbuRdsCBDZMx:wuDWZTpMZSB2IsuEaxcnbXXSyrHddMx
  • TLSH
    T196232A003BE9C22BF2BE4F7898F26205467EF6A72603D5491CC451975713FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2