Extracted

• • Target
    7e0aa7b96d35f0a633c65b45b9f022d9d6b2b877ed8f3292ad34545b1d1f765e
  • Size 45KB
  • SHA256 7e0aa7b96d35f0a633c65b45b9f022d9d6b2b877ed8f3292ad34545b1d1f765e
  • MD5 3de6b64ae6656cd3c75dbcdbfb497e2f
  • SHA1 416d2b562ed9b8f264a7a01be36a10d8b30274c1
  • SHA512 247899210656ac961540d586b17b121130f39577368a5c6b9cc6113b2569bf801eb1621e53d89f28badce0455e42d29bed0c019c019e851d5d455cf820344035
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qF+UJ+XOoJ9hU/NPIEfzjbIgX3idwJ8q7qiOnBDZUx:cu7e5TH2A2DU0eI9hyqEf3bfXSdW8q7R
  • TLSH
    T1CA232B003BE8813BF2BF4F78A9F26145867AF2637603D54A1CC4519B5723FC59A42AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2