Extracted

• • Target
    3b39213bb60c70ec44634086ae4062e43bcd389ae30e5c4ec9521fe0a6effe58
  • Size 45KB
  • SHA256 3b39213bb60c70ec44634086ae4062e43bcd389ae30e5c4ec9521fe0a6effe58
  • MD5 1e4102e48ec2d1a9a2f362cc3f986e8b
  • SHA1 50e682850e1a1f5f677b2665c6f4dd779a3c4736
  • SHA512 4f971b887b74c861b4beda8dc86a94931887e55f56f32b2a67d58537ef1ce892c8d6f96386d8aeab5d0bdb832668d64d4ae7557f2a84e4afb6a816e5db01b291
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q98wD/y/aqPI/zjbUgX3izknR1V9y1Y4WhBDZsx:EufspTf2g23kh/3b7XSaW1Y4Kdsx
  • TLSH
    T1B7231A003BE9C12BF2BE4F749DF26145867AF6633A03D6491CC4119B4713FC69A42AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2