Extracted

• • Target
    7b7bae8e9af34951f3ed39b9b03a619a74ef216d1538629690941436d41a2f24
  • Size 45KB
  • SHA256 7b7bae8e9af34951f3ed39b9b03a619a74ef216d1538629690941436d41a2f24
  • MD5 585497ccb35efba1f8a5410123fb7877
  • SHA1 9a8c3078b7814fcd7239833b41bc91d99aec1376
  • SHA512 ac0cf3e240687dc867f4282898b78d6380dad4563c17e4d693876caf53cdad65f58aca46607696bb4df374070a2cdfa5e298216c3c19a50cc664185d007da5df
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9zzjHy/aKPIbejbrgX3i8ynw8gdnBDZ8x:0uPrpT/qY2QnhbSbUXSHw8wBd8x
  • TLSH
    T1CD232B003BE9C12BF2BE5F789DF26105467AF5633A03D58A1CC4119B5713BC68A52AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2