Extracted

• • Target
    3bb11b46783d24c6c5366ee896a579419f16f9576a9bbbbe85d74e1c7cddb10c
  • Size 45KB
  • SHA256 3bb11b46783d24c6c5366ee896a579419f16f9576a9bbbbe85d74e1c7cddb10c
  • MD5 acc22f2f182157b303de14ec71208893
  • SHA1 bd8805dc23018a145df2c9b5459f22ac4f7d028d
  • SHA512 ee2cc191d52649d5be1ecaa71a7318187d293c8c3a162f104a94239b8c0c994ff161fa2592a8299bde2dc6d2b80f2a55a73e3b46b1a760789c3291381fad6f31
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q479Ya/qfxOPIXzjboRgX3iltcKKpX79TyXHq9BDZ2:8uUIpT4vAj2faKC3X3b3XSzKX792XKTU
  • TLSH
    T126232A003BE9C12BF2BE4F78ADF26145867AF2632603D6491CC451975613FC68A52AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2