Extracted

• • Target
    c37e7486b3a6a3feb39c0abf0f31049da78a696d6f2358e7d33fea9449eb8b1b
  • Size 45KB
  • SHA256 c37e7486b3a6a3feb39c0abf0f31049da78a696d6f2358e7d33fea9449eb8b1b
  • MD5 d4187cd20bbc8630844c76daacda2a16
  • SHA1 0fc1223482bff8ee149737906b188e41bc2aa4cd
  • SHA512 2b06f21cd7346029ca1361d692b184671fde3e3198fd329c01a52819e4847d169e3e6e2569c638ce1730142210761f4436a42fdd16e123dfbeabb2913806f53c
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAbgzZUpx7PI8vjbcgX3igaheob3IOjFkXsTIBDZcx:UuKWgSJTwRf2ron8bbzXSLQePFkXYude
  • TLSH
    T1BD231B003BE8813AF2BE4FB898F26145867AF6632603D54D6CC451D75623FC6DA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2