Extracted

• • Target
    f7cdf0913f1600f60e3ef3c868e9e0cf74c91d4ed3b7acc928fce7e821c6790a
  • Size 45KB
  • SHA256 f7cdf0913f1600f60e3ef3c868e9e0cf74c91d4ed3b7acc928fce7e821c6790a
  • MD5 3b10b85dcc71cd09711d641b3bc88540
  • SHA1 0c8d04b3e096e2e1e5a2e8aa3ae85ec83f348bb7
  • SHA512 5e3c3b215d748d5dabd999c8fa31f60ea7d8e59c6f18e9c9eca77acef07271803e1b28ab6e5cd4439aa428e728887ea47d19290f1beb902e3109fd2e8c1893aa
  • SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qjoO5QPCBjPSNjPI/zjbzgX3i9WtbujTIlSKBDZ8x:0u2vpTDe+2vO5sMSK/3bsXSRBUd8x
  • TLSH
    T163232A0037E8C12BF2BE4F7899F26145867EF6632603E5491CC452DB5623FC68A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2