Extracted

• • Target
    7ff597d9bd46f9ce0109d95d0053c94aff1812c379b86a48015ef632ae46d8dc
  • Size 45KB
  • SHA256 7ff597d9bd46f9ce0109d95d0053c94aff1812c379b86a48015ef632ae46d8dc
  • MD5 3d44233758a3c36f288e19e79718f83b
  • SHA1 ea42d99c9848c663d58e93a0ac515574133ed200
  • SHA512 c99f6fea3105eaf2b7b2ca02c4476d25363b53ba5bd7a2d1e9c70548a4ce9214b4bfea8dc10619b2332c32a21596ecf41a9cec0fee26584cb070d260484623dd
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9nDEbHBqj2OPI/pzjbegX3iogRyPHYR4P6CrqxhBDZu:EulCJTHl42IyoK3/p3bhXSLEfY6P6+qq
  • TLSH
    T187231B003BE9C22BF2BE5FB4A8F26145867AF6633603D5491CC451D74613FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2