Extracted

• • Target
    0c37e1152dbdd75a35840cfc0d698d1a22d9fb2dcfdffc396603b699c850ed96
  • Size 45KB
  • SHA256 0c37e1152dbdd75a35840cfc0d698d1a22d9fb2dcfdffc396603b699c850ed96
  • MD5 f531584db5c2f7398c79d765c75edc8e
  • SHA1 0cf5ae392a5e6eff847db7f04abae9ceb78a5c85
  • SHA512 239957b3894034809e264a892ce60ccf99c3337aa8f98e4330d41e7817c0421176988417cc4eceeef755042658a293a95489d141e15a2bfd13e0aa8edd055577
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1aqJaxjwHuPIPzjbDgo3ive5gvTt1YW8BDZcx:RuxkJTgip2f3+3P3bcoSv2AfYPdcx
  • TLSH
    T10C2329003BE9822BF2BF4FB898F26145467AF6637603D5492CC451DB5723BC6CA426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2