Extracted

• • Target
    3b568eb001e860b52b6cf0d3d687ffdb335c5bd7649176ec956962740b5631eb
  • Size 45KB
  • SHA256 3b568eb001e860b52b6cf0d3d687ffdb335c5bd7649176ec956962740b5631eb
  • MD5 20a493becb549ffd3c61166a2f1b43bc
  • SHA1 f75404588fc7d1b0b13ddf91a40bbdbecde95a93
  • SHA512 3ddc33658a24c13f9909fcb74d84f3b0c90bcb9b0c9b2014d16472a5068e41896171eb86477e52e07f974ac1b69fcdba805619681b3e72a21e7f7f1936a691f2
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1u8kLyuOcvukwZPIfzjb0gX9iIMgCyLxCqjzBDZMx:wuZ8pT1tc238LudlwWf3bbXMIrxLxhjy
  • TLSH
    T10A233A003BE9812BF2BE4F7899F26145467AF6632603D58D1CC451DB5A23FC68A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2