Extracted

• • Target
    836e867964b63c173701d1ebe85896089a4a948b4cfa68e74163cba8b2db0579
  • Size 45KB
  • SHA256 836e867964b63c173701d1ebe85896089a4a948b4cfa68e74163cba8b2db0579
  • MD5 1f20143b86ea211d1b65ec1f0a0b8b2b
  • SHA1 7f2f712ae907f00a22d1b2afee5497a8e4f3095d
  • SHA512 0fdec2d1d25bdb76f26642f941492755536bc65e37a32840c6d5cf88aebcbf0fb8e2fac06caf8557e3a1aa456836ffebd068c9089541b35dc7d49d8cfd31645c
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVOT9Qpm9PILzjb1gX3iR0AOEELKN8FbBDZkx:suJdpTPdI2ZQL3bSXSRtmZDdkx
  • TLSH
    T1C2233B003BE8C22BF2BE4FB899F26145467AE6737603D9492CC451D75623FC2DA426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2