Extracted

• • Target
    7fcd97d29609502d18beaeb1203ad4ed496a6c5d4938bd03b398b62acade12d1
  • Size 45KB
  • SHA256 7fcd97d29609502d18beaeb1203ad4ed496a6c5d4938bd03b398b62acade12d1
  • MD5 15aae3caf97ba57e3771313dd593799e
  • SHA1 3ba27f6319b578afec59c13f635ba56d3a7923ce
  • SHA512 3e50702c7bab89aaaaf0c2da0e1d7947e575deab330b35e2c112f6b90a55976af8918f51575247cde66a9b49e06fa3f0daca91805f287a720192dafdd6310806
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9nDEbHBqjSOPI/XzzjblgX3i5z6+kHeYu6CtExBDZsx:EulCJTHl42IyoO3/Xz3biXSY/Hsodsx
  • TLSH
    T187231A003BE8C12BF2BE4F78A9F26145867AF6633903D5891CC451975623BC6DA42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2