Extracted

• • Target
    a7a3f2ef463e14c3c70f8e367d9383846c0e983d934453e86dc022b79ad80ae3
  • Size 45KB
  • SHA256 a7a3f2ef463e14c3c70f8e367d9383846c0e983d934453e86dc022b79ad80ae3
  • MD5 76f854a9bcc6fb522589a279569b4230
  • SHA1 ddb84ce34c3c0fa3baea19d88c6536a9c4820ac4
  • SHA512 3fe0e4b92702e4707bef1193480f80a2a4f28ff2e1779bdfd547d49c9a87233813320df543fccaf2c73f608faf1c8d88546034a412b3e1f5d585cbcfb06db65d
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4gozfy3CKPI0ajbzgX3i68QO8dwtpwqoSBDZ0x:8uUIpT4vAj25TR02bsXS68QOT7rd0x
  • TLSH
    T14F233A0037E8C12BF2BE4F7899F26145867AF5633A03DA8D1C84519B5713FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2