Extracted

• • Target
    36383fc47d735088336c01b994473987bd5fdf527731ca031bc4d7ea58f2599c
  • Size 45KB
  • SHA256 36383fc47d735088336c01b994473987bd5fdf527731ca031bc4d7ea58f2599c
  • MD5 bd8cf3d2138f922e1008f3332b83b492
  • SHA1 d2807595f4b82a710e709840f4c682049db5b875
  • SHA512 9d5e9ba7c60ce7f74d170c1b2e57dadcd425d286b48a9ca65f518ea12b71f408a0b20ab9ba77d44ecf5fd8be766eca351e048d1cdd1cc8c3826716e916b9d9fa
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFQeeXKSocbbbQtN8/nPI6kzjbcgX3iXrioQ2JJ5WBDw:MuLAZTnbg2YeH2tNKA6k3bzXSXeoQ2Zj
  • TLSH
    T1192319003BE8812BF2BE4FB8A9F26145867EF2732603D95A1CC451DB5713BC686526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2