Extracted

• • Target
    1e7a7e78280eacd4d14053180c6b1653ac66fd48f5de3727a523d20e94028943
  • Size 45KB
  • SHA256 1e7a7e78280eacd4d14053180c6b1653ac66fd48f5de3727a523d20e94028943
  • MD5 81d77e958ffc17c4ebc9a4592c3f8859
  • SHA1 51319c72ed6b1be201d2f953d9e3ee9fe6c12d16
  • SHA512 be025357b62eb2701ff415542dda44af397ee5f50c41972d54fa965a86004639c55b5fdcadcf23a71eda711cbd95059e5b5a45873bc71a73772288494f805919
  • SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qr8uwZQaKkPI5zjb7gX3itt3JK0h7OABDZkx:vuogpT7I62hI53bEXStJJK0haWdkx
  • TLSH
    T152232B103BE8813BF2BE4BB899F26145467AF5736603D94D2CC411DB5723BC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2