Extracted

• • Target
    37c40d75d1ddb5b110e4c19e48baf71d33978d56c424f135c1da59f3652b28b4
  • Size 45KB
  • SHA256 37c40d75d1ddb5b110e4c19e48baf71d33978d56c424f135c1da59f3652b28b4
  • MD5 d827e574e7cd49da6081a10650fea927
  • SHA1 fbe0ef33034fa060a60d2af8f0d664fa79de6d35
  • SHA512 ac7f09d007f4506267871fbc1185bdef3958cc555502ed8213596ddefbdd6578922d38de5e57248bc6a4fef7801c295b0392d5592cf7eed51cbdbdcf6b47d822
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAaLiE02FjMdjYkkmPIxzjbrgX3iobBaABDZMx:kuSOpTPOP2KL9wQPx3bUXSoNfdMx
  • TLSH
    T199231A003BE9812BF2BE4F7469F26145867AF5732603D64A1CC451DB5A23FC68A436FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2