Extracted

• • Target
    7a7dc99bb741cc427f5c28aafcc711ae6d091922b79e13b88a4fdaa6598f9e62
  • Size 45KB
  • SHA256 7a7dc99bb741cc427f5c28aafcc711ae6d091922b79e13b88a4fdaa6598f9e62
  • MD5 d1baba648118b28be179673d16b90acd
  • SHA1 eba08ab0baa1e012ab3b1fc3ce5dce6d3f8bf4f6
  • SHA512 af2a7d2d13cd93c89cb32e7fb7c2924ae97ef4dac7dd76fe757ec3002af1a04bc006ad239cd771955c441f271111e9df5de1c91d16a71d04278bc8a99aaab514
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwY7lt440WMOPI0szjbkIgX0iFWmErS7fKBDZMx:ku40ZTXEb24gUM30s3bkfXR0/rYMdMx
  • TLSH
    T125231A003BE8812BF1BE4F78ADF26145867AF6733603D58A1CC451D74A13BC69A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2