Extracted

• • Target
    7b0e164e892afb4f75dda4d7e110f41cbc32b0c86cb423b4eaf2b5303e961910
  • Size 45KB
  • SHA256 7b0e164e892afb4f75dda4d7e110f41cbc32b0c86cb423b4eaf2b5303e961910
  • MD5 e215d0814d53261787af70fbdb4d54e8
  • SHA1 2fde8d9185721f568f26ae0d17e2c21005be4d19
  • SHA512 ae2f5095cd04ad05f38570a1e8578a23d7343387c82963afd8b5958cde990d9a2285260b735a70d29ac23aa80815bac1036915417210b794696cfa530b281b3e
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qA/+GtCVnJtHuPI+zjbUgX3imqvriN7aGLQBDZcx:UuKWgSJTwRf2P+TB3+3b7XSvvriQGyde
  • TLSH
    T165231B003BE8862BF2BE4FB498F25145867AF5637603D58D2CC441DB5623BC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2