Extracted

• • Target
    b3dfb68f3df5488da4143f1b8b80468625d789148b8e9eb2fe9ab41bcecb7f8d
  • Size 45KB
  • SHA256 b3dfb68f3df5488da4143f1b8b80468625d789148b8e9eb2fe9ab41bcecb7f8d
  • MD5 aac01608fdedae0e3cd2b636eaa102ac
  • SHA1 20588bc350c7ca63ca25d429c65cb33d907de7a1
  • SHA512 6e10b52da03567f884f8ad7aee46f1bd237d147d7c78b0e7ffeb3809d27dde8d66cf7d884f2270893e3bc23c0d26d23c712f4388e1d940b3e530b08e083d5f57
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9TZoyTM4PIX/jbqgX3i07S+KCozn7PUI7BDZsx:EulCJTHl42sh0XLb9XS0opPDtdsx
  • TLSH
    T143231A0037E9C22BF2BE4F7899F26145867AF5673A03D58E1CC4019B5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2