Extracted

• • Target
    7a52f2fcd2c08ca8537a17cfd8a51bcd2d5bedf375ad907a018f6f919a3bfb9f
  • Size 45KB
  • SHA256 7a52f2fcd2c08ca8537a17cfd8a51bcd2d5bedf375ad907a018f6f919a3bfb9f
  • MD5 db9ac34ec305d5f41d92baeca0cb1451
  • SHA1 a22115b6b62bf7718386b0e895e02a1027af13d2
  • SHA512 a07ce4967358c470c2c410a94222587e48f106ee83612e4f1fb599511712545ae3c27fd6d434c9cc111b79e80aac30d72e204c0de17af9e82ff5d853a2efc775
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9aELL0YjSOPICLzjbRgX3iazOEpB7nEpgf5KBDZsx:EulCJTHl422bG3CL3beXSxEpBTEwUdsx
  • TLSH
    T121231A003BE8C12BF2BE4F78A9F26145867AF6633603D5491CC451DB5623FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2