Extracted

• • Target
    7b1b90c0cb0176532009fd60d5f23a70aa4e35a91559e9806063977e5ac0c228
  • Size 45KB
  • SHA256 7b1b90c0cb0176532009fd60d5f23a70aa4e35a91559e9806063977e5ac0c228
  • MD5 c4b64645612c9e89375a66dc6ef35805
  • SHA1 0437c5e52f05c875de22cd4991c3a08b9f050f3c
  • SHA512 d0c1ede3f67513d83ad84fd14332dbf231a61444aadc5a810afd2c557f2e866f8e9f526c5ab456ccb9887dcfb67fa4b2c4c5010f8ebe98c5a8061caa2e069c76
  • SSDEEP 768:QuflpT8AkKuWUch7wmo2q9VO5QPCBAPSNjPIRzjb8gX3iEalHOTvHuEBDZTx:QuflpT8Hv2EO5svSKR3bTXSEky5dTx
  • TLSH
    T19E232B003BE8812BF2BE4F7899F25145867AF2673603D54E2CC451DB5613FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2