Extracted

• • Target
    7cb311dc1c8734dc708ebeb95348f1d8cad5dba04a0e24090a6bc4eb4ac6f540
  • Size 45KB
  • SHA256 7cb311dc1c8734dc708ebeb95348f1d8cad5dba04a0e24090a6bc4eb4ac6f540
  • MD5 ac266b799a6a23c02ff826d8af71c920
  • SHA1 487f57b175fee3a19b7edcc1916bfbcab9e8c384
  • SHA512 9ff59cab1fee637a3dfaff02cb3b2fd6bd120145f98bf56bd8b905a85663816a33ad30c07715b427f9f7a3cdfffd224c73c00577eae923f5e74498ab472b93d1
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFo3HE4eVoOPIGjzjbDge3iydBPX64psBDZEx:MuLAZTnbg2BU1o3Gj3bceScRQdEx
  • TLSH
    T153232A003BE8812BF2BE4F78A8F26145467EF6B33603D94D1CC4519B5613BC696526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2