Extracted

• • Target
    7b572bcfa4eb1b5af0ded232dff82fbe778627f857032a4c8051595ffc5c61ed
  • Size 45KB
  • SHA256 7b572bcfa4eb1b5af0ded232dff82fbe778627f857032a4c8051595ffc5c61ed
  • MD5 fe8f2621dcf306d72ce8a92f1d7983a0
  • SHA1 d19f0521ca1a767f3b461d550599ff962fb20426
  • SHA512 dcc1d47501c81322b2804cc9f557f63466f04446615bc73fc632d5396d5ae4165bb12556ae76e0a78a808c269dfa21aa12dabdb5e4d7c980754e5df9c9fc0f08
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q11Bz3QKx7PIUmjb5gX3iQenKFH+SaKoxqVBDZcx:RuxkJTgip2AV0UKbWXSQeK9+SaQdcx
  • TLSH
    T18B231B003BE8823BF2BE4F789CF26145467AF2637603D54D6CC451DB5623BC69A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2