Extracted

• • Target
    7937bacf593f95614a62718793eb026640e6528b2aa969d2d54d422d2d146314
  • Size 45KB
  • SHA256 7937bacf593f95614a62718793eb026640e6528b2aa969d2d54d422d2d146314
  • MD5 96a6715c49d804297696eab1a201fe31
  • SHA1 655d6c4cf38f802de3a52131a7d7818ed9475b62
  • SHA512 fdfadc1e882cc936c01aa11408564487a568a9a536c8181d858342b211053d37483ac4e2e99589062c967185d0455ad3bc3716ab647dbbb6a4967077d5a15da4
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4UITnyHaaPIjzjbFgX3iikOfNlRMIIOvBDZ0x:8uUIpT4vAj2wE5j3bCXSWfNlRcOZd0x
  • TLSH
    T1D1232A0037E9C12BF2BE4F7899F26145867AF5633603D68D1CC4129B5623FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2