Extracted

• • Target
    36a798201ab60ece2ed85beb43205563167fe23d7633b3ab3b7d616d295c2112
  • Size 45KB
  • SHA256 36a798201ab60ece2ed85beb43205563167fe23d7633b3ab3b7d616d295c2112
  • MD5 56b6d1c31fbf882472b7aa361ee72b30
  • SHA1 a168905560a7c5746fa30472d9e14dca46beeb60
  • SHA512 0aa8bb6a4fb4a5c2472b75e28bfa55d888c05ead686b63137773d6e971e15e4d81bf876e58d09f4b159ce506dfda1fbadd193f92b29f023487b26406062561db
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAI0e3+Kv18iZPIezjbKgd3iqcCJSu2WOLBDZMx:kuSOpTPOP263T6iWe3bddSaLAdMx
  • TLSH
    T16C232B003BE9C12BF2BE8F7899F26245867AF6633602D5491CC451DB1623FC69A435FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2