Extracted

• • Target
    7011a729e67b41d4fd7b24fa701a1148f16a2df31092157c26b3e2e5c901d1d1
  • Size 45KB
  • SHA256 7011a729e67b41d4fd7b24fa701a1148f16a2df31092157c26b3e2e5c901d1d1
  • MD5 e1a424d0ea6aff66532728e6c58a9029
  • SHA1 c2488657f220a480194feb79fc3c1e194416b681
  • SHA512 afc434e6e391199ef09646b65ca2d78e234b6e06504573463edce22225388d894227d96944dabdb88659b65192b70f0b770e0e6012afd2d21e1054aa00f4ca2b
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlQZTohEaSPIHzjbkgX3i/34oaubGYs9TM/BDZMx:wuDWZTpMZSB2N4Ea7H3brXSfaaGYsZMm
  • TLSH
    T1C4231A003BE8C22BF2BE5F789DF26145867AE2637603D5491CC4429B5613FC6DA426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2