Extracted

• • Target
    637e598b38cc32821b7444256b158ce46de19bd61b5f9e43a9e5537b0e7a0047
  • Size 45KB
  • SHA256 637e598b38cc32821b7444256b158ce46de19bd61b5f9e43a9e5537b0e7a0047
  • MD5 86c5692c53db2c08afa3207129ea6ecf
  • SHA1 0297033fa0f7e432b484331538fba35ff3e61c0a
  • SHA512 d094b787f705d33a08e780ccb8287deaffec83a4c0417710f864dd2e5af1ab83985a3e4af9d76eb178c698b617ccdf7cca7c38f413925b69d3940d0d7338eed8
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1g5+ZGj9HuPICzjbEg33ixHwesSjQh5UIBDZUx:cu6YepTPso2J2+3C3bL3SOesnh5UudUx
  • TLSH
    T14F231A0037E9C22BF2BE4FB898F26145867AF1637603D6491CC452DB5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2