Extracted

• • Target
    3b63f100ebd51b71732db2d39477d87d6726b409ebf5f4808f872c87c74cc6a5
  • Size 45KB
  • SHA256 3b63f100ebd51b71732db2d39477d87d6726b409ebf5f4808f872c87c74cc6a5
  • MD5 4bd6557fa25cbea5108d60a9ed538085
  • SHA1 388d37d70034bc9f667a6418996a04b5b7019d5b
  • SHA512 c6fcf0983d6b232d62ddd6397e3989eb609a4a7c54a43050bf77e117fe302fa0b46792945b050ce3677059f8b821de5e6cc89e4c673c15bce76d6db503dedba7
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9NwzBNMwpGPIMPzjbbgX3x1RHSB82sCnrBDZsx:EulCJTHl42yWGYvMP3bkXhT12swdsx
  • TLSH
    T1C3230A0037E8C22BF2BE4F78A9F26145867AF6633603D64E1CC451D75613FC69642AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2