Extracted

• • Target
    0236f62d45d8d1d4c3f462ad0ab5478e60bc867653aa87b91655393f1d738be2
  • Size 45KB
  • SHA256 0236f62d45d8d1d4c3f462ad0ab5478e60bc867653aa87b91655393f1d738be2
  • MD5 b81d50240b0f872bb9932eb4fd3929c1
  • SHA1 9e63d8263cabc69a2ff2a145d8cea6f983fcdd0b
  • SHA512 8259bf86f4a1c03bafb43ba1b934c36c7cb46889eb74ea09739ddf5de453711a2fb4972dd1654ff93a3c1f99587bb6a6be86a575e6968bc1c142b8ab3bae3327
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qA2eqpG3jHuPIMzjbGgXJibk+rWkrnCBDZcx:UuKWgSJTwRf2mzM3M3bZX4bMdcx
  • TLSH
    T1CF231A003BE98126F2BE4FB899F25145867EF5637603DA4A2CC451DB4723FC2D6426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2