Extracted

• • Target
    d36d43b0f1a8e11c30044c4686684eff9a9935a3c5f9a17384c93c479dbfca4a
  • Size 45KB
  • SHA256 d36d43b0f1a8e11c30044c4686684eff9a9935a3c5f9a17384c93c479dbfca4a
  • MD5 ca11b495eca61535c06b153a85fc04c9
  • SHA1 fed41c764d0fec13b2ca69d2bd80dbf31094367f
  • SHA512 a20968a06ceb88cf810822fce8245827c810a86d2523102f60255559b7a19ef00ab789ac3eb04fe20b7d8046b9742023c4ff3cd8edc5d473d565803994ed54b5
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlyNd3u40cMOPI08zjbigXlih08anp6Thr12BDZMx:wuDWZTpMZSB258+M3083bFX0hngp6wdO
  • TLSH
    T16F2309003BE8C12BF2BE4F78A8F26145867AF6673603D58E1CC451DB5713FC686526EA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2