Extracted

• • Target
    7a784367f9faed9eed4326845971d77169a3dd299c21a3c4d55501206e1790ef
  • Size 45KB
  • SHA256 7a784367f9faed9eed4326845971d77169a3dd299c21a3c4d55501206e1790ef
  • MD5 4e186d7cb8dbf4e8533e12f5b2cc3a54
  • SHA1 471303fb90b457d6146052ef581afc50e86b22be
  • SHA512 53ce0331a58ff17a96f347b3765ae4759c79b3068668c752fc29420d35295ff7678f0b3970678780e72c4d1b546b77b4303ee26351c11617c0a4d94dd1b51b0d
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwkSAFcKoabbb4ZhM/RPIAEzjbegX3iuVqVBvAEERs0:ku40ZTXEb2oSAvQZh6OAE3bhXS0e4qzY
  • TLSH
    T17C232B003BE8C12BF2BF4F7859F261458A7AF2632603D59A1CC451DB5B13FC68A526ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2