Extracted

• • Target
    a7b00c38162f135bbfb79d66782014541654e649853a4b997f81c48500e6b0af
  • Size 45KB
  • SHA256 a7b00c38162f135bbfb79d66782014541654e649853a4b997f81c48500e6b0af
  • MD5 0757d4def7ca705c30b9a14ee86d93ed
  • SHA1 8d181358d73e2578d77338627422489152700c6d
  • SHA512 c61f4398e762b5f6e0645865890c664626c525053d387620c736566c5ac5b39378bd5a185c2836f36f9953155993d0ef57c896254929a468da71d3c1136a69ad
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q44O5QSCBzHSNjPI7zjbSgX3i9Uy9OJqCbpBDZ0x:8uUIpT4vAj28O59ESK73bVXS/MJqCbd2
  • TLSH
    T1E8233B0037E8812BF2BE4F78A9F26145867AF6637603E5491CC451DB5623FC6C642AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2