Extracted

• • Target
    a7fcb47413d3ebefdbce2449b53763e2f9243bbd225b92bdf0a11329cf9b3e37
  • Size 45KB
  • SHA256 a7fcb47413d3ebefdbce2449b53763e2f9243bbd225b92bdf0a11329cf9b3e37
  • MD5 59dac6be4aa6d544b47c65b661a319e0
  • SHA1 7da4a339a6283eb773e06717b0d7a4a86aa3d389
  • SHA512 e42f216303f525766d2d5556bd872794917cac231c6442b23e777b3393eea712f05400f3f53a45f06c991667f2f753591da6f9389a1145da17975dda5790bf50
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFa3xK6yZoOPItzjbCg53i5aP8gA8WudBDZEx:MuLAZTnbg2vcPo3t3bl5S5+8gAHuzdEx
  • TLSH
    T166233B103BD8C12BF2BE4F78ADF26145867AF2A32603D54D1CC4529B5B13BC696426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2