Extracted

• • Target
    7f4adfd1059c99a8f166f5a442075aa2b26b263ee9f2702f2a481eba86517281
  • Size 45KB
  • SHA256 7f4adfd1059c99a8f166f5a442075aa2b26b263ee9f2702f2a481eba86517281
  • MD5 fcc29266952e6f70d0a192f44042e2e7
  • SHA1 8effa5e81f41c3a07085635cf1065c5d5e6b6966
  • SHA512 507efc2d3dae32f024bedf394adcb42a46c53a79a865dff02bfdc2b70373b0280280aa71bf20107547ef067d8cccf7e9f29055b90b3b4cab82c420ab342ebb49
  • SSDEEP 768:guKWgSJTwU6NkWUGnaSmo2qAsj0UwPOlehAPITpzjbogX3iCClxd4BDZwx:guKWgSJTwRf28j0/OghlTp3b/XSCed+Y
  • TLSH
    T143234B003BE8813BF2BE5F7899F26145867AF6637603D64A1CC451DB1723FC28A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2