Extracted

• • Target
    7284baefcc168bb4acd8e02c43ae1e09562e55678aa43f33a778048a0add34b1
  • Size 45KB
  • SHA256 7284baefcc168bb4acd8e02c43ae1e09562e55678aa43f33a778048a0add34b1
  • MD5 c0e2ed44fd8f05672524b01e5fe0cb03
  • SHA1 81f2d6403bd5b2a295c8496bfd00e8dbf12948e8
  • SHA512 07c3a7d6bc247d4d48ccfe3c19a6e41758e1c5e821964396e54149db774caf8c283726518d858bb68fe7ab526dada98c7bd2117ffe7dee99eb42461cc2957df3
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9voopCBK9INJPIZzjbRgX3ik3vnOZLMRBDZ8x:0uPrpT/qY2ao6bIwZ3beXSK/EWd8x
  • TLSH
    T1E0233B003BE8812BF2BE4F78A8F26145467EF6636603D54E2CC4519B5713FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2