Extracted

• • Target
    7316c12fcd173eb6ff1bcfa08b9300de6bf054a9e4e4f602c58fd8dced0af9ff
  • Size 45KB
  • SHA256 7316c12fcd173eb6ff1bcfa08b9300de6bf054a9e4e4f602c58fd8dced0af9ff
  • MD5 e5a4642991527363fb4a9590a82c2420
  • SHA1 02c4c685a6b3880a16af7c5f96eb5a91e40261b9
  • SHA512 2a458fa7c306f946791d03111d3c318fae0a8fa6655fe48db910f3201f8f529f37fbff09ac25e0b3f608844da86c725093349f70c2212e6542f1d0ef98b2755b
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYgCXtTt/PICzjbtgX3iwAq9K5KGbrHguCiBDZ0x:8uuSpTgyf24wuC3b6XSq453qcd0x
  • TLSH
    T15A231B0037E8C12BF2BE4F7899F26245867AE6673603D58A1CC4419B5723FC69A427FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2