Extracted

• • Target
    7557a5f6cad2998450cf760a384a50cc4fe890aa6a5066d4ae6ce8b8a4c10a28
  • Size 45KB
  • SHA256 7557a5f6cad2998450cf760a384a50cc4fe890aa6a5066d4ae6ce8b8a4c10a28
  • MD5 7679b85e0b566f08fdf2f008c52ff224
  • SHA1 bfb3f67ff1f28ee30fba48ebb02625a7421918e5
  • SHA512 989cbc9d51bc09594d24c22d48d99b0aa3c83b2191220d69be198a8a259034bab750a2d0e0885074450210165a4934ee224402afa06ce63656ead9d0de6b5784
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFw3HO4SNMOPI0azjb0gb3iFiDJnpQyrjBDZEx:MuLAZTnbg2R+JM30a3bbbSinDBdEx
  • TLSH
    T1F0233B003BE8812BF2BE5F789DF261458A7AF2633603D94A1CC452D75713FC69A426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2