Extracted

• • Target
    7b6858b305a89ec6dbafa287198feb8cdb413fe701a9e5bfac4eea48914b21e6
  • Size 45KB
  • SHA256 7b6858b305a89ec6dbafa287198feb8cdb413fe701a9e5bfac4eea48914b21e6
  • MD5 0ece95442e910a1d8788e20dad40a7bc
  • SHA1 c1cb1c3319d630777df5b252947d2d4dd7ece407
  • SHA512 745b018ac6b2516ae9a1e59c3293f345cd87f66686b2a561bf384759ef441cd6f134556dcc9e46ad99d94a659b22a9e2d6cc751e4d31adf25f6572e4e0fdb787
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFg3Xo5EayPI2zjbfgX3idoavhS/gBDZUx:cu7e5TH2A2LQEab23boXSdbhS/2dUx
  • TLSH
    T1B1232B003FE8822BF2BE4BB8A8F25145867AF5737603D54E1CC451DB5613BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2