Extracted

• • Target
    b7e8640e36fa5d2d0c6e5b06250a64d8580a056a79b61a10b9fbf38c3fbac90c
  • Size 45KB
  • SHA256 b7e8640e36fa5d2d0c6e5b06250a64d8580a056a79b61a10b9fbf38c3fbac90c
  • MD5 1bdaf9028ddc229d8425bc484a0ce4bf
  • SHA1 b95d3c1727f764adc76390370d7d77f8a5fc0374
  • SHA512 4d45ccb57c3221dbd60a65a8c10d04c78c0e57031cf06ab80f44bf150abb11fb274cd0b5881a0e6bdd109adad579fd497a108491387e740c1b4dacde0942eea9
  • SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qrFpzZUrR7PIMzjbmgX3i5o1hSUmmc8SLviBDZkx:vuogpT7I62iTFM3b5XSchSUmmFSLvcdm
  • TLSH
    T108230B003BE9813BF2BE4FB89CF26145867AF6632603D54D6CC451D75623FC68A426EA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2