Extracted

• • Target
    c7bff4002baf4e897c8af4138d09c2797cbbef3a298fe55ee1037a321c217314
  • Size 45KB
  • SHA256 c7bff4002baf4e897c8af4138d09c2797cbbef3a298fe55ee1037a321c217314
  • MD5 08831daea55dcb6bd75c300177f31108
  • SHA1 d6fa6a6ba40602b50b3660f3722091008bbc9c62
  • SHA512 b545d7cc20db9ae9a33258bdbbc56dcdd03efbdd34da5f000cf021da19c6a342a37f9fda9b0b2f720f3699e46e246ac593d18ef24e004e0d1a83a943f04e3901
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYJCHyTtTPIPzjb+gX3iG3QkI2EAIlXkXxBDZ0x:8uuSpTgyf2RnKP3bBXSGytkfd0x
  • TLSH
    T1B5232B003BE8812BF2BE4F7899F26145867AF5673603D58D2CC441DB5723BC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2