Extracted

• • Target
    b3ec966d052f8ea1548abea9f3398957705f4c6f149dfc478fc5eb9590fed125
  • Size 45KB
  • SHA256 b3ec966d052f8ea1548abea9f3398957705f4c6f149dfc478fc5eb9590fed125
  • MD5 38349ba5428f6171015ba0703cbc8ff3
  • SHA1 584d764038f9abbb61e5f2963f7fb5941cf93167
  • SHA512 fde9ea1bacd554a38c65c7aaafbec581d74ffd26836697e8511f899b8572d8ec440391d31a09042c69ead2fc8267b9e8288e9a17990a776ba72eb461075878b5
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwX3Xo5EayPImzjbvgX3ikKzuKmiFBfBDZMx:ku40ZTXEb2zQEabm3bYXS79FbdMx
  • TLSH
    T1B8233B003BE8812BF2BE5F786DF26145867EB1637603D54A2CC441DB5713FC69A42AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2