Extracted

• • Target
    3b0aacd2e383a2b39e33e3099cfeec4e9081e882547dac2c9417b1890222662d
  • Size 45KB
  • SHA256 3b0aacd2e383a2b39e33e3099cfeec4e9081e882547dac2c9417b1890222662d
  • MD5 b76a50dde92e7bd45dc1b9287695ccdb
  • SHA1 57abf71bae037143403239277fe20fd2d74ddd85
  • SHA512 8089075647263697009fbc4e41b8ee31a159c59bbff3b8d1127ffa54766998f4e7eb5315919552109e779980f265f631ee68716cee1e7310a01424dfe9f22f19
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9oozHyvCKPIiZjbqgX3iwhndonsHlBDZsx:EufspTf2g20L5iZb9XSWnWMdsx
  • TLSH
    T116232A0037E8C12BF2BE5F789DF26145467AF6732A03D54A1CC4529B5723BC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2