Extracted

• • Target
    7f9100c3b16b66288a544bd1ca60573cf17596b7c05d35ca1b8a6734d4e8da0d
  • Size 45KB
  • SHA256 7f9100c3b16b66288a544bd1ca60573cf17596b7c05d35ca1b8a6734d4e8da0d
  • MD5 8aaf7d9aba434949e2ca4ac03a02b2d3
  • SHA1 e81323b8140e0b10287003bd24c4c43173f9bb36
  • SHA512 3987d386fbfb1b798652a1a7b53d62708dfa7b4ae2bb90ebee38d557cbe447e5f5e67134f2f215020462f8a2a2c26e41c8dca67cdb4c79c239be22b3180d972a
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9K9EsxFNbeOPIMVzjbdgX3LBY4ilJ/gEUyqcAMBDZsx:EulCJTHl42djX63MV3bKXbBY4iz/hDqr
  • TLSH
    T195231A003BE8C13BF2BE4F78A8F26145867AF6637602D64E1CC451D75613FC69A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2