Extracted

• • Target
    7c9ad84d753b0db049499405340ce724141dc160302d853f41cc6bbeebef19db
  • Size 45KB
  • SHA256 7c9ad84d753b0db049499405340ce724141dc160302d853f41cc6bbeebef19db
  • MD5 70f004efac2798dac6b80ba34d5a700b
  • SHA1 0001b3b45ffdbb247dbd5f50ef4df7c6c4b53d8e
  • SHA512 3e4a4b6bb07ed12675ecb808081eaf0703492d5b479a2a993bdb0845c02aa2aea63a978a52306c57fdc67ce19988a12da59ba0b76fa6568af87fc578935ff0c1
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVW9PLzizyvtLjZPIXzjbegXxiptfPcuC5D1pj1BDZG:MuBGJTPho2L9HiGVjWX3bhXgp1kuK1pc
  • TLSH
    T16A232B003BE9C12BF2BE4F7898F26145867AF6636603D54E1CC451DB5A13FC6CA426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2