Extracted

• • Target
    36754f54655295fe00e3a21f0441747fa178d6e1f4e22eceb11f78f33e6284a3
  • Size 45KB
  • SHA256 36754f54655295fe00e3a21f0441747fa178d6e1f4e22eceb11f78f33e6284a3
  • MD5 367e8e88234c49ab6898fb40c0787915
  • SHA1 ff7a919fbfdee1a0c7ad665966f98ec6d0fad824
  • SHA512 4715defbe6a3de1a195e2081bf50959088c0bc39b58b01889de9273b7f16b8f7d2edfe0bf8fb1af4d52a2f1f7c68206f0a5701c0b47fbc52194865f2b14cd360
  • SSDEEP 768:4uLZZTUAoOSWUYZL8mo2qF1eeXKSocbbbQtN8/nPI6kzjbUgX3ipEJHpnlBBDZbx:4uLZZTUTn2teH2tNKA6k3b7XSpEJJZdV
  • TLSH
    T174231A003BE9822BF2BE4FB899F26145867AF2732603D54A1CC451DB5713FC69642AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2