Extracted

• • Target
    8b3bb1ba64433b420a1e58d1e78e369371d35c01ab036956a50e587f38c46e91
  • Size 45KB
  • SHA256 8b3bb1ba64433b420a1e58d1e78e369371d35c01ab036956a50e587f38c46e91
  • MD5 a936d93f0fd87784d1a86fb996bd9fc7
  • SHA1 b3199be2d7ab5d0ae3b896d96eaee9be6151e132
  • SHA512 a2a5f952a2c6c74521e926b1c72eb26ee718172fd978b7a4ca1c8ba2827736c0b1dece8ad48076d46acda583c1b4210d013a69c6d588caf3dc24f98ec0e208fb
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVCT2QAm7PI1CjbjgX3ijJywHcPTlFn/s/BDZkx:suJdpTPdI2+T1Ob8XS0xLld/Edkx
  • TLSH
    T100231B003BE88136F2BE4FB898F26145867AF2637603D64D6CC451DB5623FC6DA426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2