Extracted

• • Target
    c7b23911687fc8849721298fafbdd81c03366f8ee9ab4158a921c9a042715d25
  • Size 45KB
  • SHA256 c7b23911687fc8849721298fafbdd81c03366f8ee9ab4158a921c9a042715d25
  • MD5 81bc124b348ff48289c0e05b81c197a0
  • SHA1 da7dcf2a133eb761e7b5cabbb3d98866e7d51b29
  • SHA512 55f7fb749f1a032185061692bfdb36be05af73195920227e564fd78a11e7af47dc2b6e1444169bab4d191326c60cecd5029e411dff5b0ca3f3dcd37f11ea06f1
  • SSDEEP 768:cuqb5TrIGuCWUoKXMmo2qQGseXusMkFX8vnPIMvzjbpgX3hhjjKej3BpEBDZUx:cuqb5TrhG2VeB1FXiAMv3bmXxh3ydUx
  • TLSH
    T10E232B003BE8C12BF2BF4BB899F26145467AF2736603D54A1CC4519B5713FC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2