Extracted

• • Target
    36432ac47dafb10a714c99bd8dbdaa34a88d7490af8d2ff9af869c0f8500e840
  • Size 45KB
  • SHA256 36432ac47dafb10a714c99bd8dbdaa34a88d7490af8d2ff9af869c0f8500e840
  • MD5 e1ca27cbc4ee25b5d26bc82cc98d3a51
  • SHA1 ffebe485a10f50e7a97d60e4910a3ff2bfc78289
  • SHA512 7a896559319d640a2ba3d1e44c140291f257767c43bc860590ce3b6b167602be673783cd89ac7792f02007b263bacafe3fcd29f40162c633ab258b7cf80f105b
  • SSDEEP 768:5udApTNctooWUS7C+mo2qt5HO9YjoHPICYzjbSgX3iu05gzqvkFqHhOcLJBDZ0x:5udApTNmU2Z6kgCY3bVXSn6zyUSh3Ld2
  • TLSH
    T1F6232A003BE8C12BF2BE4F78A9F26145867AF6633902D54D1CC451974623FC69A52AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2