Extracted

• • Target
    37c9704c45265156b9f078d3b661a0325fca2262ddd944fe6fdcd469457d9247
  • Size 45KB
  • SHA256 37c9704c45265156b9f078d3b661a0325fca2262ddd944fe6fdcd469457d9247
  • MD5 c40af3869b92e451528e17f2f1845c0a
  • SHA1 60198720db5a8288eda742807feb29f8a72698f1
  • SHA512 84e7d9445d722a59d5b954601c3cce76e8a88a2546cb7eeaa2e8f5552c703ea03dd6c000bf87c593384581b5ea21b2f34b402a31408131ed761294175add4e24
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1Jw0QbKXPIrzjbNgX3iTkGc4iksvhYeBDZUx:cu6YepTPso228r3baXSTkX4XsvhYwdUx
  • TLSH
    T1A9232B003BE8812BF2BE4FB89CF26145867AF5632603D94D6CC4119B5623FC6D6426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2