Extracted

• • Target
    b3cf70bf92957e7728a5362ee37a7c2d49b75c5f745dffef79671264e32f25cb
  • Size 45KB
  • SHA256 b3cf70bf92957e7728a5362ee37a7c2d49b75c5f745dffef79671264e32f25cb
  • MD5 ade8fac46449a4d008725b5b0dc7a23e
  • SHA1 7be8e4104dccb8048099748b3a74132369feda18
  • SHA512 a9f4cf12a987e64608fcb786e6110293f2622da1e6a249acb16ed1a36c91ceafb7477f96c821e30d129d58002c87abde6f39d59cfda7bc14d9ff806add3149f1
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAjT2Qpm7PIKJjbAgX3i6uR1s2VzPeBDZcx:UuKWgSJTwRf2GeKpbnXS6uR1scwdcx
  • TLSH
    T1F2231A003BD9813AF2BE4BB8ADF26145857AF5633603D64D2CC451DB5623FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2