Extracted

• • Target
    7ba419873ba3b38f856a72f2d60a1f1c95834a93a497f36f441fcff7be525940
  • Size 45KB
  • SHA256 7ba419873ba3b38f856a72f2d60a1f1c95834a93a497f36f441fcff7be525940
  • MD5 935fdcf0bd13bf37ac6d547adf999251
  • SHA1 4c8faabec32a31ef5d605763563b25fa6d3d1205
  • SHA512 ea867d3c5872373efd96eba8f2c23bd3b60a19aec83773f2a5d8b23a661e46d5b7cda970f3ff393dccd9ed0189121de22c054bd3057c9e3dc0e445c16c28cc14
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qF+UJ+XOoJ9hU/NPIEfzjbLgX3ibr5CsISC90r2kuB0:cu7e5TH2A2DU0eI9hyqEf3b0XSbNtSO7
  • TLSH
    T167230A003BE8C12BF2BE4FB8A9F26145867AF2633603D55A1CC4519B5713FC696426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2