Extracted

• • Target
    db7c77e2252db33483f7ea0dcab493bbfb354f5f9d29a3220308555b77e12e46
  • Size 45KB
  • SHA256 db7c77e2252db33483f7ea0dcab493bbfb354f5f9d29a3220308555b77e12e46
  • MD5 ccfa8b3a10d5f28184d63c2e1fea94ef
  • SHA1 a8663174914bc0e06251375bc8999f664dddca29
  • SHA512 a2ee53c70aa652a1babe9e920df91b41568e7aa86390a174615c5728d10c4fb6dce688978133b2909abdf263c9b29e4dbc63cb762a77b994c3c5c7122202b4a6
  • SSDEEP 768:YuJdpTP3tcsWUODmqmo2qVX0UwPOlehAPITpzjb2gX3iMKWdpyBETCpBDZYx:YuJdpTPdI2u0/OghlTp3bpXS5Q8BET6w
  • TLSH
    T1CB232A003BE8C12BF2BE4F7899F26145867AF2677603D64A1CC451DB5723FC68A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2