Extracted

• • Target
    db3cb879af1af14e08d20ce3ba772c286691779f5de4831afa2edd09f995dfa1
  • Size 45KB
  • SHA256 db3cb879af1af14e08d20ce3ba772c286691779f5de4831afa2edd09f995dfa1
  • MD5 ae981a490039b06b8453c871c575b317
  • SHA1 1cb3a5a20e32ff3e1a994e0c0c1da1c975c94ed7
  • SHA512 0184b6c3cd5e140aa6120f80d43f3977bdfbb2366f7163ef83db691258127d592a7778e71a281f51f084c5c990d44658418463eb157c98352f8e8dd9bd968610
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFTlsHoPEaMPI1qjb9gX3iOrUuVl+2nVBDZUx:cu7e5TH2A2muuEax1mbqXSOln7dUx
  • TLSH
    T182231A003BE8822BF2BE4B789DF26145867AF6732603D54E1CC4519B5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2