Extracted

• • Target
    7f22e5c3ba2cc4b4818a93e50edcb9dfdd119b88eb997fe188d93d1b13921f01
  • Size 45KB
  • SHA256 7f22e5c3ba2cc4b4818a93e50edcb9dfdd119b88eb997fe188d93d1b13921f01
  • MD5 0344ea8c6ab26e3ea6a3f2ea324bbd65
  • SHA1 65912ef0c1e067a8eecdd676ec113d3aa59f7a9f
  • SHA512 764df81e8c6d7cacf4e80640125b7ea9b72fae8a617c58c81aab3ab0ca005df13b593953b1c67447eaf517d7d06623d04036ae635b88d509bb5858506868e9c3
  • SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7RCHyTtUPIwzjbqgX3i/wuYCWyAy85BDZ8x:0ushJTDXgH2Injw3b9XSoFy98nd8x
  • TLSH
    T101231A0037E8822BF2BE4F78ADF26245867AF5737A03D5891CC441DA5713BC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2