Extracted

• • Target
    7991466bf1112694f2154846084a512afd8560f809ff35f1241783a7cff736fb
  • Size 45KB
  • SHA256 7991466bf1112694f2154846084a512afd8560f809ff35f1241783a7cff736fb
  • MD5 f418e72f668e521ebccc681576475f30
  • SHA1 5b630bd8e8039e6d972ff45d463041afaf932264
  • SHA512 7bc898bf028280e21980c5cc9f235837997965a4a0a7ed6c21386526a8abc62fc3c17b1cb593983014c25a38eaf6c4946df526cfa5d03f49646dc63e5358b14e
  • SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qr2b30GYjHuPI8zjbVgXwiafjvNZln20gBDZkx:vuogpT7I62hw/383byXNS7E02dkx
  • TLSH
    T1F2232B003BE8812BF2BE5FB4A8F26145867AF6637603D6491CC452DB5613FC2DA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2