Extracted

• • Target
    37f2345aea3b0e694482e3606f01c589b2d9360e4ffb2c81955f99b19137f4a3
  • Size 45KB
  • SHA256 37f2345aea3b0e694482e3606f01c589b2d9360e4ffb2c81955f99b19137f4a3
  • MD5 c57dc434da0cc3586ff72b23b6a84ec9
  • SHA1 8e5e7bde067860c676b7f17574d1f0043848dcd8
  • SHA512 59438682c9b0b658f691a1e3ac5e3263e4b78fbf74a966a65c6e9fff46823c69485bc6444ec4ef5b9ff34f0b45cd82c86ffcce2f377f041cfdd568b00708f695
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1nfkLyuObvtkjZPIuzjbkgX5iYO5IBR4bo4rBDZUx:cuR0JTPjY2OfLuyyjWu3brXIKHR49dUx
  • TLSH
    T16B233B0037E9812BF2BE4F78A8F21245867BF6637603D54A1CC451DB5613FC6DA42AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2