Extracted

• • Target
    7ad309c637552957adcef8da90de808d3645fe8607c438bf0582dfae7e160fe7
  • Size 45KB
  • SHA256 7ad309c637552957adcef8da90de808d3645fe8607c438bf0582dfae7e160fe7
  • MD5 8a38dbdbcb736d4c34bc6148b554aa30
  • SHA1 505b079ddf5bab2c38a708193916ed918212fa37
  • SHA512 1ff94439c3dbfdf6e0445c37f7cc94cb375a5f9432ac22cb7cf7b36f4ce1d1b77fe6e5c40085dc6cde049bb1747dba12b10241828a75c7fafa215a5b58283b15
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9zCOtTMtPIizjbIgX3irkeDTsPHfelxWQHgBDZsx:EulCJTHl42MRvi3bfXSrnDqebH2dsx
  • TLSH
    T12B232B003BE9C12BF2BE4F78A8F26145867AF5672603D58D1CC411DB5623BC6DA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2