Extracted

• • Target
    7ed3e83f2cdb2f259b050ca0051cea7d50626112f4ecbb4b4ba8b6badcddd547
  • Size 45KB
  • SHA256 7ed3e83f2cdb2f259b050ca0051cea7d50626112f4ecbb4b4ba8b6badcddd547
  • MD5 5bff508b79bdc49d809a4baf49790959
  • SHA1 801217233a5e898a85d8d75fde12545d707c030e
  • SHA512 8d7bc10f978c53056e41f09623dec7e4cc7069f52082afa21d54e9f6bbe176e9cae9be8dbe3d46a55d7f95cc707785d2bc648715ae758087859ac7f93b9496f8
  • SSDEEP 768:5udApTNctooWUS7C+mo2qthRzMwnOPIZzjbkgX3ikshIKa7chCGBDZ0x:5udApTNmU2qA+3Z3brXSFhda7oZd0x
  • TLSH
    T18B232B003BE9812BF2BE4F7899F26246867EF2673603D68D1CC4519B5613FC686426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2