Extracted

• • Target
    7c3827532e6a875eb2fdfe6b96f22016d5529ca7fae2f354312715fc5b046b4f
  • Size 45KB
  • SHA256 7c3827532e6a875eb2fdfe6b96f22016d5529ca7fae2f354312715fc5b046b4f
  • MD5 efeea369606d993197b2685e95e94ae3
  • SHA1 61a1a12df6752105748bbb9944c918f3ccb06aa1
  • SHA512 4b5d73f87626d11927e53ff43907ee82291be62a0b517a623508a80a97c73538988f192879715783691e2857ca8dfe0fac803631a66cfb9de3f9beaebe52e386
  • SSDEEP 768:QuflpT8AkKuWUch7wmo2q9fozHy3CKPI2BjbugX3ibPBOrfk5hnfanYZXBDZTx:QuflpT8Hv2BrR2RbRXSgDK9fPLdTx
  • TLSH
    T1F8233C0037E8C12BF2BE5F789DF26245467AF6733A03D6491CC4119B5723BC68A526FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2