Extracted

• • Target
    b3a1225579c1883b24ba7ecb13337b0e0780fbcc6f25264c0117e55f6ba9fbb1
  • Size 45KB
  • SHA256 b3a1225579c1883b24ba7ecb13337b0e0780fbcc6f25264c0117e55f6ba9fbb1
  • MD5 c2433c6726cd23bd185fb751af2940e3
  • SHA1 cc12847b2634c599d47840501e8d14e9ca17bb55
  • SHA512 917b2ba0f7b8272986bc062a6e08676eccff3ef1491e7ab549dff32d8dd33d52d999c34761d6085c051cff9052bd6f09025cb5360fd1d51782cdb2e19efec829
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtSCSwTMSPI5FjbQRgX3iFvku4DBuaIvtg19fIHNDBD:5udApTNmU2lgG5NbQeXSFvD4DBunv66Y
  • TLSH
    T186231B1037E8812BF2BE4F7898F26145867AF2673603D58E2CC4519B5623FC6D6426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2