Extracted

• • Target
    c7476852d2baaa81358687f6d4a775617d60d85cbb33ad3d0e795c06f6102308
  • Size 45KB
  • SHA256 c7476852d2baaa81358687f6d4a775617d60d85cbb33ad3d0e795c06f6102308
  • MD5 3c84ffc527815b248c0ea195f91ce956
  • SHA1 3bd4d5b38517e5c53f2676e9700d8082e2d96749
  • SHA512 23151e66a001e3ae3a39849243261649faac0aa39d183bcfff906eb72c483d2782dabbe9af506dbe4fa2a43eb9226c543f3b555ad1b7adc79f421131d14ba22e
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtXCXtTtSPIpzjbVgX3iE9MLYDvX0+N6QaUwdHBDZ0x:5udApTNmU2gwxp3byXSKQYD/0Qnw7d0x
  • TLSH
    T141231B0037E9812BF2BE4B7899F26145867AF6673603D54D2CC4419B5723FC68A43AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2