Extracted

• • Target
    07fee17bd219fc1016a80af7d6ff1f9e6e69e09c266a19b695b58170d20a3c76
  • Size 45KB
  • SHA256 07fee17bd219fc1016a80af7d6ff1f9e6e69e09c266a19b695b58170d20a3c76
  • MD5 c91842e9a69f651861a967c1a6e00fd0
  • SHA1 02a3fcb95a129d733f765bad6a42ca1761d7fd01
  • SHA512 78f2fccb2cbc68d8a048be562966432cc7e976d45cca09987f8b63fc9d979f207f3e2d9b68cadcd91284f656e8b6ab1aa8f475747f2a876c41d4403e2dc4267e
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVRwZQcKkPI8zjb4gX3ihLM0/BDZkx:suJdpTPdI2Tq83bvXShLM0Jdkx
  • TLSH
    T157232B003BE8813BF2BE4BB89DF26145467AF6633603D64D2CC451DB5723BC68A426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2