Extracted

• • Target
    c7c046ea533fd6687bddb6f86eb4c20c46d1efe4f065947c600bc5554652bd33
  • Size 45KB
  • SHA256 c7c046ea533fd6687bddb6f86eb4c20c46d1efe4f065947c600bc5554652bd33
  • MD5 7ad614553593fccf14ff34fc45aed122
  • SHA1 e7fc278b82cc72d9ab0007d9f85322e4085e90bd
  • SHA512 9ecf8ec290a5032eaf3758d196cc720675d3faff30a0bae8a6b2cff641853a593e6aa43a1bd477121770b6a53c7957d1e6d78df0c103873f8e18e67c9ae69892
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9yiaLMwJAOPIcAzjbBgXAihcqdyJZuelsnfNBDZsx:EulCJTHl42l5n23cA3buX9OcyJZutnf4
  • TLSH
    T1FE232B003BE8C22BF2BE4F7898F26145867EE5673603D58A1CC451DB5623FC6DA426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2