Extracted

• • Target
    7d478455e1a0bfd240963907e9eb1e426cd6f97b6c0e9c5f72f15d9bf16c1d68
  • Size 45KB
  • SHA256 7d478455e1a0bfd240963907e9eb1e426cd6f97b6c0e9c5f72f15d9bf16c1d68
  • MD5 0462d0b0d4538d8fc7b9d9e5599894bc
  • SHA1 88766bee9ff2e7878bad014b12037429fa620135
  • SHA512 33f2f3f5db12bc8de57538b1ea07c1b8b7c4d53aa08324d1e75adc0934b33299fa3d25745854712df0975ef43d2fb4212a1a54074bde9333d9ab7c66f7c5e269
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9Ewz/y3qiPICzjbbgX3igaFdsSbPWvVmqRU1kmBDZu:EufspTf2g2v0hC3bkXSeBRtodsx
  • TLSH
    T13F232A003BE9C12BF2BE5F78ADF26145867AF6632603D6491CC4119B5713FC68A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2