Extracted

• • Target
    f7ec609890d91b6a574a0a9e2fe3d60769fe6df56fea04ca3592a7dc45e68657
  • Size 45KB
  • SHA256 f7ec609890d91b6a574a0a9e2fe3d60769fe6df56fea04ca3592a7dc45e68657
  • MD5 b17d9c847066a86aab22570f53f32e19
  • SHA1 f27f892d3a2b4f0232820a74005148c5db43a89c
  • SHA512 485925f95859d4f0cd12cd6aa135b6a30e0142ab1daf7c01cbb016f8f8c64978e8978df86e7648e23ccea55f3a74e525a007f948ef2a977d4666ea876c930927
  • SSDEEP 768:QulLJTEs+EgWUKJTGmo2q94DEbHBOjTOPI/TzjbkgX3i2iTZFkeDdF0BDZTx:QulLJTE9X2XyYf3/T3brXS2OFFdYdTx
  • TLSH
    T139231A003BE8C22BF2BE4F78A9F26145867AF6633603D54A1CC442975713FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2