Extracted

• • Target
    7faa980a7dccc7dd790de0719fd391e1c78d8067265b4a263b7dd2e1c7dedf15
  • Size 45KB
  • SHA256 7faa980a7dccc7dd790de0719fd391e1c78d8067265b4a263b7dd2e1c7dedf15
  • MD5 18e512627566d7db9272c0e9cfb31030
  • SHA1 7575c76b0124059b4ff139016275f5590d7681a7
  • SHA512 ad171e2866c82af4d31b96fd11d431cff92894eac72d3b575c452361adaf7dac44ca9819c2cc40ddf376e38f2bd7f2b1cf91d01d6bcd5a0348b4a8e044987d41
  • SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qrLxJdxrPHuPIbzjbYgh3i9UTthGwTJslKZg6gTBDQ:vuogpT7I62YxR3b3bPhSCT75slKStdkx
  • TLSH
    T183231A003BE8812BF2BF4FB499F26145467AF6636603E6492CC451DB5723FC6CA426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2