Extracted

• • Target
    7a3a7e25bb46805b04afc879737c3eb5e1debd56a80e62f69a05d7742a82ee0f
  • Size 45KB
  • SHA256 7a3a7e25bb46805b04afc879737c3eb5e1debd56a80e62f69a05d7742a82ee0f
  • MD5 27ee8b90dccb0f69f61dc30c3ecc8e81
  • SHA1 f2b6d0855d4e50dfc431f1f7e071af4c82784d23
  • SHA512 f0971ad467aa7fdf6e5b503f89b48fe4bb951fb04c2ddf1c8c0f08305847f9abceaa87a634f712e6d7bf554e1ff296f5251def2e76be2f02814f2ee0471f5da1
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2ql3seXusMeFX8vnPIMvzjb+BgX3wAHjBWeRnOdzrP:wuDWZTpMZSB2deBPFXiAMv3bpXgAHjBW
  • TLSH
    T1C4231A003BE8822BF2BF4F7899F26145867AF2632603D54A1CC452DB5713BC6DA526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2