Extracted

• • Target
    b4f3d6cb3f6109a9c691e26f39115600d73798c1fa11345703177b2f54b482ac
  • Size 45KB
  • SHA256 b4f3d6cb3f6109a9c691e26f39115600d73798c1fa11345703177b2f54b482ac
  • MD5 2b61b70b25f443082ecb7c30eb59f96c
  • SHA1 c86a78d7f321f859cdd8022aa7a735eba439ac61
  • SHA512 7fd16c41f9194f6d22ba834ec8f9eb1fc159ed005dbf79499c5c681a974fed10a7ca0e1c0ebc02533ed3a02656cee71703a4bbf6ecd297b9d37355129a3af7e6
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAAxJaxjwHuPI+zjb5gg3iWQ9Fqo0Dl1BDZcx:UuKWgSJTwRf2Qe+3+3bWgSXFqo0D5dcx
  • TLSH
    T15B232B003BE8C12BF2BE5F789CF26105867AF6636603D68D2CC451DB5623BC696426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2