Extracted

• • Target
    3b88af4008ff78acfc3f9eb5770a6d0c924e39386635c458da03d56ef17c5b86
  • Size 45KB
  • SHA256 3b88af4008ff78acfc3f9eb5770a6d0c924e39386635c458da03d56ef17c5b86
  • MD5 02f097ee023e64d5391e0dcbae28cc8f
  • SHA1 94ec5639eda33a007b631f33713f35cd669f2579
  • SHA512 6440d2ba0764eb2902c44e15cbf9297254cd3aa079290d6512e976ee217c2f65b08ff33a74452e2dbba325f1e3000707afe74bb2dc9427d4e2a2842e54847dad
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAbgzZUpx7PI8Rjb2gX3iM/bJIUCa6YWq34cnBDZcx:UuKWgSJTwRf2ron8BbpXSMNO91qocBde
  • TLSH
    T1A0231B003BE9823BF2BE4FB858F26145867AF6732603D5496CC451DB5713FC68A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2