Extracted

• • Target
    b3cef6f55ed2b0f1c17559aa982295209e7a6fd0157af0c86e5b4802c044bc3b
  • Size 45KB
  • SHA256 b3cef6f55ed2b0f1c17559aa982295209e7a6fd0157af0c86e5b4802c044bc3b
  • MD5 56a62027ddee44130d76ab9d59dff283
  • SHA1 de9cc12805ee2ed8dc0cd01ca6f24fef4f72b779
  • SHA512 be5fffa8be7020649bdce47466d6f9844da100f2fd524b59783f98dc5d6dbc803f8197ac4fdb05336e1c105c4b17355b4d49ced52f927f87b9a7ca40b7700307
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1P/qpG3jHuPIgzjbigXzix8oUpJWONbGEk4UiDh2:cu6YepTPso2yIM3g3bFXux8oQ7bGExD0
  • TLSH
    T1582319003BE8822BF2BE5FB499F26105867AF6636603D68D1CC441DB5713FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2