Extracted

• • Target
    a7614da2f00d932c0c5073275d25ad4e6eff101104ac239931aa21eb70e23bff
  • Size 45KB
  • SHA256 a7614da2f00d932c0c5073275d25ad4e6eff101104ac239931aa21eb70e23bff
  • MD5 5cbbc07ae2c0e5da31f5d497caa73692
  • SHA1 214faea95142a9558c8a9ec5687195778c1d95da
  • SHA512 b2fc94a33a1d342a843e72440a3fa128b7d07308002da2c69f48d0d29490f04fad6da8fe9035e071d26f65a0224af69c8e8fdaf7c212bc84fbe85a469c70763a
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYjn1YJBOPIx7zjbdga3ielqDQcb5FzVqPBDZ0x:8uuSpTgyf2ziz3x73bKaSCcnE5d0x
  • TLSH
    T1AE232B0037E8C12BF2BE4F78A9F26145867AF6633A03D54A1CC451DB5613FC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2