Extracted

• • Target
    37ff80d376a3fba8e4ff45dd6947501738bb84fc437db9d9bacd727927107d40
  • Size 45KB
  • SHA256 37ff80d376a3fba8e4ff45dd6947501738bb84fc437db9d9bacd727927107d40
  • MD5 a0be4c324460aaca324176b2746ad6ce
  • SHA1 899b86ec9afdf7f5ff28a2abbcff4707ec6420e3
  • SHA512 ad9f80d14242d04a4e0224b7090c20481886b362ed1fcd702f8581efc39191940eea3f29651574de12b687c1c92a9752f0c585ed2837274cf4843c681c29d911
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVQ0e3+Kv18iZPIezjb5gQ3i1XEk+vTBDZEx:MuBGJTPho2n3T6iWe3bWQS5Ek+v1dEx
  • TLSH
    T142232B0037E9812BF2BE4F78A9F25245867AF6633603D6491CC451DB4A13FC6DA42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2