Extracted

• • Target
    cb3b31e3ab12bacd3ac9dbe10db7851010572415765495ccd74200245133624c
  • Size 45KB
  • SHA256 cb3b31e3ab12bacd3ac9dbe10db7851010572415765495ccd74200245133624c
  • MD5 bb23a18f373c2fd8631fd33f08a99ef4
  • SHA1 21bb89b9e3420fd4e1c2d778cda26ef976c812de
  • SHA512 7423d9a3e180e311d803bb3bb5d2f354d551219bd16ad028c3639918f13a992893139bb19bcd18e5f9e087c36a2bf9e9121d331bb0e46cd60e041e6694344b7f
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVQ0e3+Kv18iZPIezjbig13ikLY8vxB1wBDZEx:MuBGJTPho2n3T6iWe3bF1SQY8vxBQdEx
  • TLSH
    T19E231A103BE98127F2BE4F7868F22145867AF6636603D5491CC451DB5713FC6CA43AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2