Extracted

• • Target
    f7de54887ef9d4a3f0b734694fd2876051fb8826b845b54cd55911cbf81ea150
  • Size 45KB
  • SHA256 f7de54887ef9d4a3f0b734694fd2876051fb8826b845b54cd55911cbf81ea150
  • MD5 465ffc845e2d368d5d0cb219f08b07b1
  • SHA1 2ee55afe2fb5382308fb8c3045b751db6c0a36e5
  • SHA512 91a123de60af9356d64782a34f10473f9160d5a87b68411fd00627021f33bcc426b8559f26f50ea23cb7c35ede62071ccf4307f550b769f8ff311b8aeb48a39e
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4j9Yq3q3hOPI2zjb6gX3iTeUFSap/UlfKqYpRBDZ2:8uUIpT4vAj2naCq323btXSTeWpsf3Ypc
  • TLSH
    T1E3232A003BE9C12BF2BF4F78ADF26105467AB2633603D64D1CC4519B5623BC69A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2