Extracted

• • Target
    7557dde6c3b9e34b147659d80d2d73997cd7c3b9fa5f7afa3a9f3f0ef76f8168
  • Size 45KB
  • SHA256 7557dde6c3b9e34b147659d80d2d73997cd7c3b9fa5f7afa3a9f3f0ef76f8168
  • MD5 bcf671b961b910fe3962f6ce14f7a64c
  • SHA1 e5bffd75aa563dee559fa5cd97e9beab1b6a38cf
  • SHA512 d1029b50806b57d982dc3bdb7b7310fc8ea23ef8a3fb3d008caafa6c814423e5d0f3d173bba487d9fb5bde624c584ddd4b027da1d660e1e00ef7dad173e67698
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q13oCa/ld3APIXzjb9gX3nCO576mA9kmBDZUx:cu6YepTPso2OE/T3lX3bqX3C8lQdUx
  • TLSH
    T1CD232A003BE8817BF2BE4F7899F26145867AF2636603D64D1CC451DB4623FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2