Extracted

• • Target
    e3b701bbbbb43c7d3f2f2cf55f70de8d5f99c237928a811bb37d4382a4249f6d
  • Size 45KB
  • SHA256 e3b701bbbbb43c7d3f2f2cf55f70de8d5f99c237928a811bb37d4382a4249f6d
  • MD5 c6fdda444246b711b798623f712054f1
  • SHA1 3e97ba7b08dfcff2b7ac377cd58fd63723a0ce62
  • SHA512 5c868509442dd74cefd1c9a4c3bf9b66133c7263cc6f09a80307ad66188bb5f9e0577bb13272603d7742f7bfc094e18fe18c1f4f5dba423b44c31725d2605267
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtkZoyTM4PIXqjbJgX3inyU0DX7QA0nqJvTBDZ0x:5udApTNmU2lh0XmbGXSyU0G4d0x
  • TLSH
    T1FA231A0037D8812BF2BE4F78A9F26145867AF1673603D58E2CC441DB5623BC69A527FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2