Extracted

• • Target
    36825e9b34ac6bb327d450b553f7f61e9939efb83a40b6740e0bb9d6d7a6c6c9
  • Size 45KB
  • SHA256 36825e9b34ac6bb327d450b553f7f61e9939efb83a40b6740e0bb9d6d7a6c6c9
  • MD5 8fd0e26cea3e7608c3663fc5881405d4
  • SHA1 6cd2d8a8190ac55f9fecee476592b09156040259
  • SHA512 6427124ec04d7dce5e90bcaf15373c50f73befa31d7fdd925d431b3df82da1822c711ea1ce888c41444149e13816c3a93f74d5ac713ad7e25554611f22b3bb3f
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9e/rLzlJAOPIc6zjbkgX/imSoP/mVi9cJoZABDZ8x:0u1YJTHcw2RPp23c63brX6mlP/0GcJbM
  • TLSH
    T176231B003BE8823BF2BF5FB898F26145867AF5632603D64A1CC451DB5613FC69642AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2