Extracted

• • Target
    09a36c608790200a3ccb22176aa39d2facc2f9da6f259d60c9314bf476a494e8
  • Size 45KB
  • SHA256 09a36c608790200a3ccb22176aa39d2facc2f9da6f259d60c9314bf476a494e8
  • MD5 af905bfc3efc7d989aa5059afc6fd89f
  • SHA1 daa3d8696f4124375aff9aaf10b891e981eff412
  • SHA512 35bccbb59d46fe40bf29c01296ab7e986598cf3d94a4f709952c5323d37697b27748a69e8ea27c81f4ce80e7c62f87b60a46e037c6971250f32cdf9af648aec9
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVRwZQBKkPIZzjbIgX3i8QBDZkx:suJdpTPdI2TbZ3bfXS8Gdkx
  • TLSH
    T127231A103BE8C22BF2BE4F7898F26145467AF6636603D6496CC411DB5723FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2