Extracted

• • Target
    3a3b08da484223a4e12ee0a1ff657db6443ceabfe6c7c8a48d16e158093bf94e
  • Size 45KB
  • SHA256 3a3b08da484223a4e12ee0a1ff657db6443ceabfe6c7c8a48d16e158093bf94e
  • MD5 68771db3f999016914a069165b7756d7
  • SHA1 dacb1d98601d1fdda0bc1917dd964d717c9d2b96
  • SHA512 30c05cbcb01af77dedfba65914d0aa4b0eb3b1604ef12c4da30dc7704045833c93d23f16125a65c88d2399256ed1045557c5c00b6c3a6395959c151afe80c55d
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9Xozfy3CKPItxujbDgX3i92AzPBG2EPoSJBDZ8x:0uPrpT/qY2ZTRt0bcXS92UBWLXd8x
  • TLSH
    T1BE231B003BE9C12BF2BE4F78ADF26145867AF5633A03D6491CC4119B5613FC68A526FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2