Extracted

• • Target
    7dd7f22e6d35f40478722cc43bcd6b27d77d85e18189fe0fbf5fa6c28771e2de
  • Size 45KB
  • SHA256 7dd7f22e6d35f40478722cc43bcd6b27d77d85e18189fe0fbf5fa6c28771e2de
  • MD5 8512279c5f2edf9d651df3d681429656
  • SHA1 9359f5ffad20722c488e54a21d6437d0c6cbf803
  • SHA512 7bc33ef723bd65b08bde5fc4d1e38672abaacbdb5be4e5d267c2f34b67d0463fdd2eb9a6a98a0cdbc75de5aed3abc7fa3f8736cbdc1a8626f44c39f71639e076
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1HqJaxjwHuPIPzjbDg43ioREkCvlzXQKBDZUx:cu6YepTPso2S3+3P3bc4SczaaUdUx
  • TLSH
    T128230A003BE8C22BF2BE4FB898F26105467AF5672603D6492CC451DB5723BC6DA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2