Extracted

• • Target
    0036a961d6569068e3078e2efaf7e990552f7a97a1a942961d5d77b64f6fed6b
  • Size 45KB
  • SHA256 0036a961d6569068e3078e2efaf7e990552f7a97a1a942961d5d77b64f6fed6b
  • MD5 1b8def7965aa8f7d751fbcb8d2b19471
  • SHA1 84f4a99fa901dbeb7c957dba83bca47d43f15766
  • SHA512 ae5255948fd912b663b0a74dac424405c79cb7287a16b390fb73647738f3be0fb723c14c6e138db74b8f597dc2b03116abeeaa5c4703072775a650155b3d75a2
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9MCOtTMtPILzjblgX3i41Cs9FbM0n/GH4WE0eBDZ8x:0u1YJTHcw2TRvL3biXS+CcB/rSwd8x
  • TLSH
    T199233C0037E8822BF2BE4F7899F26245867AF5733A03D58A1CC441DB5713BC686526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2