Extracted

• • Target
    7e5acd5491707731f1d740263d2f4c1546aa31cdf35aa5f55df8aa38074a5230
  • Size 45KB
  • SHA256 7e5acd5491707731f1d740263d2f4c1546aa31cdf35aa5f55df8aa38074a5230
  • MD5 bbb034dbc7a4ca3266e1c02aee3c1962
  • SHA1 01d5dadcd6fa2c8f57a08f13cf138ec23b08f4e4
  • SHA512 025035348b683b3d07beb5d1e943d04c8cdca5324c0f344347ca5ba1896a5bc09aedc5f25656f1088221e1bf11d1f69834df0c31c8fc11292c2254c6b6d5af01
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9OoopCBK9INJPIZzjbBgX3iF/weTaSNoelI3R+Bv4j:EufspTf2g2bo6bIwZ3buXSF/Ta2hlI3L
  • TLSH
    T1DE232B0037E8812BF2BE4F7899F26145467AF6633603E54A1CC452DB5623FC6DA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2