Extracted

• • Target
    b7d970bf52c2b6322c6b644d24fdce3028c72f62691a78224f728a2a28207261
  • Size 45KB
  • SHA256 b7d970bf52c2b6322c6b644d24fdce3028c72f62691a78224f728a2a28207261
  • MD5 6e2478eed58b4cf4db47170f635d8ddf
  • SHA1 d22bd7fe8a8f37ef9b76f1a5af4b65123ba33edd
  • SHA512 8e74b1a39d0c3daf0601193b53f697b1e548f8bd1f63c1dfe46523437f34a4d3f71a08f6fe78858bed185ebd8c046264bb4bd189a37d474242e3162c5fefde05
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q17b3/GYjHuPInzjbkgXviXsc0NcVaENLFKBDZUx:cu6YepTPso22L/3n3brXKtKENGdUx
  • TLSH
    T182232A003BE9812BF2BE4FB4A9F26205467AF5633603D68D1CC441DB5623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2