Extracted

• • Target
    7f7dac45839b026fdc76f70bc7d4d46ac908f81fb69756bdc465b0c1670944da
  • Size 45KB
  • SHA256 7f7dac45839b026fdc76f70bc7d4d46ac908f81fb69756bdc465b0c1670944da
  • MD5 09f072270d0f19870dcf9a03a7080130
  • SHA1 575e0608c3b351761b984635770b27da1c4934e6
  • SHA512 0e8c794bef610c16e5a0f52d5f6278fb989841cbb3f8cac1f1d2f364fa2452553e2f1826be9963e472ecab1b1d1f1af4d5ef2b1caad077a90e95d924037c3299
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlyBlte40WMOPI0IzjbmgXJipjEMz/6wk4fTd7BDo:wuDWZTpMZSB212UM30I3b5X4pjtz/6T1
  • TLSH
    T110232A003BE9812BF2BE4F7899F26145467AF6733603D64A1CC451DB5623FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2