Extracted

• • Target
    236ada03410fe478c4b6be6e87eb2c0eb9bfff3b5e7f5a42e9524adf60c9f311
  • Size 45KB
  • SHA256 236ada03410fe478c4b6be6e87eb2c0eb9bfff3b5e7f5a42e9524adf60c9f311
  • MD5 be3f68e5843c1af92f4d68ffcd4dc3ac
  • SHA1 f3918ba8be3d942efd8ace3dd5edf1e366138ed2
  • SHA512 e2612744d751b718edb5f3c94f9a202798891090e3c48d0da67eb585483e0c635e42d75e77c98292a9ff01d304bf24713b0c21e3393d655fd14f757b7f0aac49
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlcNd3u40cMOPI04zjb/gX0iKCOXc/bVOBDZMx:wuDWZTpMZSB2r8+M3043bIXRKbQVAdMx
  • TLSH
    T1FE232A003BE9812BF2BE4FB499F26245867AF2737603D68A1CC451D75713FC68642AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2