Extracted

• • Target
    bb35f3838b972dc9c4e538660bbb2bf504939032221708f643524ea0db43cf26
  • Size 45KB
  • SHA256 bb35f3838b972dc9c4e538660bbb2bf504939032221708f643524ea0db43cf26
  • MD5 c3b8951a92bb5dfef358b446b0212af1
  • SHA1 9d5c2295468940115607d9230e8fab9508e6a857
  • SHA512 81d521b411fe391f28f7ff9aee5818f403c508c13f6257db79ff2c3b3373fdf0d280c52c5bd07772278f8caaaab62bd355ca70f6b5a9cd5c5ece5f4663b09a36
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4UITnyfaaPIbzjbOgX3i2/Zme2ZVTMHW/Fhj2HBD:8uUIpT4vAj2wEhb3bxXS2B+bdhjId0x
  • TLSH
    T1C8232A003BE9C12BF2BE5F789DF26145467AF6633603D6891CC4129B5623FC58A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2