Extracted

• • Target
    36aa1ee6b5ee45c277d102d7a0d6425bb717f5c46c96af3140a78b492b8b34e8
  • Size 45KB
  • SHA256 36aa1ee6b5ee45c277d102d7a0d6425bb717f5c46c96af3140a78b492b8b34e8
  • MD5 e11de8bd2a71895e0e55ed920aa2bebf
  • SHA1 f0c7d74c7eaec37dd2b1f8a79f72f3d197d16ab9
  • SHA512 7502b6061119d585be449e1e45768b3aff4535dec7c2e6d9774154d3bb0c75fa47ba926858771a307c74b79eae019e8ad382bf59ae9b77a590e651d6e08bb599
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qF4ZBohEa+PIMEjbtgX3iHio2R/Gk/MVUQBDZUx:cu7e5TH2A2P4EaHMEb6XShQ/G/VjdUx
  • TLSH
    T1D2231A003BE8822BF2BE4F7899F26145867AF6637603D54E1CC411DB5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2