Extracted

• • Target
    a85d32fd6da0c9be717f6bf7e726f6a037f8cf416289824ce5fb582fba37da71
  • Size 45KB
  • SHA256 a85d32fd6da0c9be717f6bf7e726f6a037f8cf416289824ce5fb582fba37da71
  • MD5 36b49326ec483dd3bcd725bae055f0fc
  • SHA1 0a939e72a2dc09acd3ab6d3ebcfb6b2c00919dd0
  • SHA512 b0f794e4b6eb929474051ae81c0f438e113868e267053e9c2e97966649034feae4f60fe838aa742f7e8fdb0dfd38319a5dbb1b8135c922546234d512c9ded891
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1emaPol53APIkzjbwgX3ivDe+tVBDZUx:cu6YepTPso2vfob3lk3b3XS7XBdUx
  • TLSH
    T1B4232B003BE8813BF2BE4F7898F26145867AF6677603D6491CC452DB4623FC6DA426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2