Extracted

• • Target
    7e3f038fd664d292ee238b43b0279919fa084d2f003001d5d085be2be677a87e
  • Size 45KB
  • SHA256 7e3f038fd664d292ee238b43b0279919fa084d2f003001d5d085be2be677a87e
  • MD5 8b28449f8c4a92fd53eed04212f3c6dc
  • SHA1 3073f359c4811a49eb5201f505c232cabdfe8b42
  • SHA512 d39f9bdf6bef10653a78a68ad339733623bfd4443756d8f3369f241ce68b27137370ddf3ac91d454b1d177e1fdacaf32f4152032ee1a82abcf5ce72327e6ed46
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYh6R8aI3OPIOzjbUgh3iriCBBDZ0x:8uuSpTgyf2J+FO3O3b7hSri2d0x
  • TLSH
    T107231A003BE8812AF2BE4B78ADF26145867AF6673603D54E1CC451DB5713FC68A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2