Extracted

• • Target
    b7fd1024c5c5c397721072b5f230606677308b4b76fe40f980ec6917e13c19bc
  • Size 45KB
  • SHA256 b7fd1024c5c5c397721072b5f230606677308b4b76fe40f980ec6917e13c19bc
  • MD5 ebbf72bb6150d177a605d2edc2f15807
  • SHA1 37f910c6ce8932546778f2ffbfc42e0eda881ed9
  • SHA512 7430f2557a31d83496d7d2403265042b183fb1de04ad9f67ded391339b35fe1e1f81270ec0fd1a4f9ba554514b1cf5fea7da9744c381f70229c82f4083f646b8
  • SSDEEP 768:4uBGJTP0BQ0UWUWHaimo2qVzsD/pneqPIkzjb6gX3iqT3A1bvwP82HHBDZ4x:4uBGJTPho2QsjJeTk3btXSqT34bW3hdq
  • TLSH
    T140232B003BE9822BF2BE4F789DF26145467BF6632603D54E2CC4519B5613FC68A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2