Extracted

• • Target
    7c9bf4a3b10af98705bfa23e60304f6577df4b39452032682970472fea125e77
  • Size 45KB
  • SHA256 7c9bf4a3b10af98705bfa23e60304f6577df4b39452032682970472fea125e77
  • MD5 c0822edea11ff28550547a1b5fe90430
  • SHA1 b8fdf0f62227600c6b4ed222c3cf35d7971c7df7
  • SHA512 f4d3adc33fce16bb33bf19795ffcde7791dd2cfbcc6bb8300a67e84b350d02f3c129ee3a31b62bdc3f2d698b2f6d2e0a5f532761589affbd485ceaa6af19bad9
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFK3hO4iLMOPI0OzjbQgX3i22a/lD8pOxBDZEx:MuLAZTnbg2vA/M30O3bXXS2RlGOPdEx
  • TLSH
    T10C231B003BE8812BF2BE8F78ADF26145867AF1777603D58A1CC4519B4713FC69A426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2