Extracted

• • Target
    c7ff22c2813f5d05ae6d34620760c24bd07cd967e6d3bc3669354d1e1dd1ec84
  • Size 45KB
  • SHA256 c7ff22c2813f5d05ae6d34620760c24bd07cd967e6d3bc3669354d1e1dd1ec84
  • MD5 9be0e194e480f6dd721b6da159d0a31d
  • SHA1 8a6e3ad1b3c4b0b633b99466ef145c3aaf1f4911
  • SHA512 7109a88dcd0933dba18eda85c06413d6ee8719257ca3b0a9d506afd53a3a81459e7e8e32597c7488862eebdb3ea6d9278785efa2f2b3a001c8111958f37d474a
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNrzjHy/aKPIbxjb+gX3i85jEfZNq8BDZ0x:5uSy6pTpoo2onhbhbBXSwjwNZd0x
  • TLSH
    T12B232B0037E9C12BF2BE5F789DF26145867AB6632A03D58E1CC411DB5713BC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2