Extracted

• • Target
    7e7692671a764304d2e5bf71bb770b2c6a2e73ef80cbf6aa19a8997ce4e21ee6
  • Size 45KB
  • SHA256 7e7692671a764304d2e5bf71bb770b2c6a2e73ef80cbf6aa19a8997ce4e21ee6
  • MD5 66be5ee79ae5820f00094ae340ee9e47
  • SHA1 08455f74d6b1acba7100148cd8d5c2b028ff2ec4
  • SHA512 623b86cf8797c6d3ae2ae7ab295a5fa2d8e06de5cbd1a0485e2d8394613db89c7aa25b5b3a84032c2b43b807ed5e94829d21a9356f8d0f17035e12ca300c692a
  • SSDEEP 768:5udApTNctooWUS7C+mo2qt+CHyTtpPI/zjbCgX3i8ZAoxBlhnBDZ0x:5udApTNmU2JnQ/3blXS8ZAoxDhBd0x
  • TLSH
    T1B0231B0037E88127F2BE5F78A9F25145867AF2673A03D59E2CC4419B5713FC686426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2