Extracted

• • Target
    3ba13b1ad2ab84649bcd6338deddd7370a930503f710eefa0d8f790101ccfd29
  • Size 45KB
  • SHA256 3ba13b1ad2ab84649bcd6338deddd7370a930503f710eefa0d8f790101ccfd29
  • MD5 715c38192ddadcb93f03c1db64c30c94
  • SHA1 a592ebdf4d542db206c2e30b5b85f4d74f0ac66e
  • SHA512 054ee9483a8efca508582e01c2c28f0bb2eacfd3bf9c03c8633144cd74c9d1f912d975abc4ae81e5ac38f6d112b15adfe011bf01b501dbc8fc64219c18b3f3ba
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1XQLD3q/vKijZPIgzjbggf3ip3/nfZTBDZMx:wuZ8pT1tc2w23iHjWg3bHfSpvvdMx
  • TLSH
    T10D233A0037E9C12BF2BE4F7899F22146867AF2773603D54A1CC441DB5623FC69A42AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2