Extracted

• • Target
    f7de9403db1feaefc96543467fce2832d7dfdbe31c51bdba821c64d7012debca
  • Size 45KB
  • SHA256 f7de9403db1feaefc96543467fce2832d7dfdbe31c51bdba821c64d7012debca
  • MD5 41480b6524bc1918b69cefe755404e1b
  • SHA1 1cd932c75f46ec415646074dc123a2b139fa02e8
  • SHA512 afce336bf36b5464b0180eb656aefce86bdd8595e815718e84987d2138005896260df9d8c5d0f495f436caa32557157e8533be86ddb887564ccc8460561b7172
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNi9YSkqXzNOPISzjb1ge3iOc1kfXsrYy6SQBDZ0x:5uSy6pTpoo2PaVq3S3bSeSON8ky6Xd0x
  • TLSH
    T199232A003BE9822BF2BF5F789CF26105867EB6633603D6491CC451D75623BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2