Extracted

• • Target
    3b4397bf71b8ece68639d14b6ccee02636e0f1b43c3f7e2bb5021b2f6b71e3d2
  • Size 45KB
  • SHA256 3b4397bf71b8ece68639d14b6ccee02636e0f1b43c3f7e2bb5021b2f6b71e3d2
  • MD5 eb6d2c7a7f5cb8355a23dccebaa385a2
  • SHA1 03b93618eec42720086df32ee10328b900ac2140
  • SHA512 cd25ff039332328e71ef68ef26ce06851637823bedbf2c7f396e4bb6ee0794e90b332ca20fe6ae6d3ef5bcb1c518f5784ae2b19323fb11fb255b8cc8be239557
  • SSDEEP 768:4uBGJTP0BQ0UWUWHaimo2qVzsD/pneqPIkzjbEgX3iOAn4JLb/IyZ6SEBBDZ4x:4uBGJTPho2QsjJeTk3bLXS7naLbAyO/Q
  • TLSH
    T131232A0037E9822BF2BE4F78A8F26145467AF2633603D58D2CC451D75613FC68A52AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2