Extracted

• • Target
    a7424cff978248cd16c52d2b20f53155c56baf27c6253a147cff66c726d754dd
  • Size 45KB
  • SHA256 a7424cff978248cd16c52d2b20f53155c56baf27c6253a147cff66c726d754dd
  • MD5 4555cc2ad3c9c1b6bdd89593f7973bfb
  • SHA1 7c7b7bfc3c51b28a9fbea7463130d0081db850ee
  • SHA512 65732ccd980c45ff2078a63b00f7d233fea1007e511c10ad6c389d4569ce73e5b3b0d8ef59668c73b5d60ecdab597cc0bb255867855b2a6697eabf3fef5768cb
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAAxJaxjwHuPI+zjbagR3ibS33PP0LjbBDZcx:UuKWgSJTwRf2Qe+3+3bNRSb6/P0LjNde
  • TLSH
    T1222319003BE8852BF2BE4FB8A8F26145467AF5637603D6492CC4519B5623FC6CA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2