Extracted

• • Target
    7d660643aa93754822b47e7ed65e0eddaddde8bc1930cd950a528172daddfabd
  • Size 45KB
  • SHA256 7d660643aa93754822b47e7ed65e0eddaddde8bc1930cd950a528172daddfabd
  • MD5 53c632479830f4f45a864e2de2102eac
  • SHA1 c67c16081cf57eb515dce0e0163475affbd0dd8a
  • SHA512 34f3bcdc697508a298590ae229252c2e2c23a2b171aec88f15b00c228b2c18e0f8a89482154fd692711f95dcbc1270954762e2f15b39e68920a41bbc973b3563
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9T9oSsqHz1OPIqzjbdgE3iJaZeui9IGBDZsx:EufspTf2g2OKti3q3bKESkZZIIIdsx
  • TLSH
    T1BA233A0037E9C12BF2BE5F78A9F26145867AE6633603D64A1CC411DB5713FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2