Extracted

• • Target
    436e20d9c7e0c93efcedbbd157d96fea3a3547676608aeea427d0e3bfa364ca6
  • Size 45KB
  • SHA256 436e20d9c7e0c93efcedbbd157d96fea3a3547676608aeea427d0e3bfa364ca6
  • MD5 b64942302a491a4e96afb51a4fb6243d
  • SHA1 8f7fd445d0cb1fff76d0ce400f03bd0ad18a9e70
  • SHA512 3dae1fdddbd73c0f473f6f849cf09050ebcb6aa854e7ec30f8934f1d6418b6e777e8f8b57c3bae78afba67c0113942444065602f2cebb4a2e483a9fffd20805d
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9m6R8aI3OPIOzjbQgF3i779yHqWdzoDYBDZ8x:0u1YJTHcw2Z+FO3O3bXFS7RyHLxWed8x
  • TLSH
    T14C232C003BD8822BF2BE5F789DF26141867AF6673A03D58A1CC451DB5613FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2