Extracted

• • Target
    3a70cbbd8befd15cb7dc81b41f50c71f18dda3698e9bf10e48fa6fd24181ccd9
  • Size 45KB
  • SHA256 3a70cbbd8befd15cb7dc81b41f50c71f18dda3698e9bf10e48fa6fd24181ccd9
  • MD5 6a0ab0f53589cfc6033cf665c394c8d9
  • SHA1 00060dfafbb4adc8b75ddc72fde2c493bf2bee69
  • SHA512 baddc453a1fb97d6743491a3b0edb07e80aa2690ee6bfcddd027aafd8db1beba84b563a141c3d81cc1603e3b44c35c487ec569fd433387f639bce7c65c498f7d
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFO9SKFWKoobbb4vhy/nPIAizjbwgX3iCev8q3bR/b/T:MuLAZTnbg2RSKdivh4AAi3b3XSCev9R3
  • TLSH
    T125232A003BE8C12BF2BF4F78A9F26145867AB2632603D59A1CC4519B5713FC6C6526EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2