Extracted

• • Target
    736cee42209180f4c941d37adf4516bc58b612f46e4eaacf60c04ccfd85f7a78
  • Size 45KB
  • SHA256 736cee42209180f4c941d37adf4516bc58b612f46e4eaacf60c04ccfd85f7a78
  • MD5 dacd16be320a217c231be962dc396e20
  • SHA1 b7f7f38137cd38284bf7da9043fcf672672ca063
  • SHA512 1b81b9bdee986da99c06beb9f2e1ff1d782b90daa811cf3104a2a69bd8d59575aa6af80d773aad6d6db8960663730a1fb920c6e9541a0d4a799cd9cb88d0257c
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qABw0QbKXPIIzjbagX3i7Eno5+3rrSzQlBDZcx:UuKWgSJTwRf2Z8I3bNXS7g7zdcx
  • TLSH
    T17F231A003BE88237F2BE4FB89CF26145857AF5636603D9496CC451DB5623FC6CA426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2