Extracted

• • Target
    3b49606b0ca7a2e9997905727423993bc0f6a6362433a1ea646678cae7545750
  • Size 45KB
  • SHA256 3b49606b0ca7a2e9997905727423993bc0f6a6362433a1ea646678cae7545750
  • MD5 c6f1eb3ca65fadc2df3c526af8a89782
  • SHA1 9db2b09e371305cfb2b9a72daea8d3f4ca1fcf7a
  • SHA512 2b071fda4f9a5935937a6df09cb9256815ae142198682b0bcf0b00f0237916ecc3d4cc6fd4a87866672e5bef98370974b8bf9883509af931ba227efc2e5fba47
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9aqAYaayNPIHzjbIgX3e3Gw+AIc4mX8BDZ8x:0uPrpT/qY2HqzqqH3bfXu3O/Wad8x
  • TLSH
    T18E232B003BE8813BF2BE5F7899F26145867EF6632603D94A1CC4519B1713FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2