Extracted

• • Target
    b3e3641188277da2551b9e3bf7e8ca9fa2b3961d56ae2a9db92c40378bc354cd
  • Size 45KB
  • SHA256 b3e3641188277da2551b9e3bf7e8ca9fa2b3961d56ae2a9db92c40378bc354cd
  • MD5 a9cdb30890dd7e99f95214addbe797b5
  • SHA1 eb727481a261c8ab5f5cf5561c225210b538287c
  • SHA512 c3a271ace4ec97bd2a41dcb2da6a4f5cb9b27ec48aa25113138e9c19a5702a57548c811c2aad828c096c96a53516e6db02ff1b1528e15aa9ad8da6e8b89c6135
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9qCXtTtoPIJzjbngX3ieYhkqRxstDBDZ8x:0u1YJTHcw21w3J3bgXS/ad8x
  • TLSH
    T1C8232B0037E8822BF2BE5B78A9F251458A7AF5673603D58D1CC441DB5723FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2