Extracted

• • Target
    537ad8880520ef3e3d0621a049b6b3cfc6a42ce347cbe7c4a52334f84ffc0a08
  • Size 45KB
  • SHA256 537ad8880520ef3e3d0621a049b6b3cfc6a42ce347cbe7c4a52334f84ffc0a08
  • MD5 9dc82dcbdc18ee1065063e34ee551973
  • SHA1 287f6bca97039a41ea8ff5b299a5216a8a5a4c07
  • SHA512 6cb633e383e83d8b69c2e71af9015f4f6de21aa60a1bd13d8235d0a75ed229f12a881bee049e713d037ede7fddc3bfc67f07ecd4a81b3eeb63ddc3757f213cb6
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNrwD/y/aqPIvzjbcgX3i0ZrLzuim9HBDZ0x:5uSy6pTpoo2okhv3bzXSSmphd0x
  • TLSH
    T104233B003BE9822BE2BF5F789DF26105867AF5632A03D54D1CC411DB5613FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2