Extracted

• • Target
    45c0436b0d74079e23a5943571e310811879b31a6e037d5dff62e9a8f02744d9
  • Size 45KB
  • SHA256 45c0436b0d74079e23a5943571e310811879b31a6e037d5dff62e9a8f02744d9
  • MD5 029e0ea092174f2f39fb29ecf06badf7
  • SHA1 37dfcebb7c5250da605bd563f8016cb3f5ab9566
  • SHA512 2ccffdc79ea59c14028e0b43d7d3ec61abb0621c184e491234a8641f819eddfac5c01ed619b6d7ef0676675a5c6cce6e85ed57e57a396e00c38a7f2dc281960b
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlneeXK5oibbb6TN8/nPI6WzjbWgX3io8Oxj/MZpC:wuDWZTpMZSB2DeEqTNKA6W3bJXSFOxr9
  • TLSH
    T187231A003BE8C12BF2BF5FB899F26105867AE2732603D58A1CC4519B5723BC69A525FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2