Extracted

• • Target
    b8adf2e5f53b855baba310f14d37e1d5b1bda7590e944eb3b88e4a009b09bf1b
  • Size 45KB
  • SHA256 b8adf2e5f53b855baba310f14d37e1d5b1bda7590e944eb3b88e4a009b09bf1b
  • MD5 d677a6949fe2ae3708117d5711a4ff3e
  • SHA1 2e250ffa69287702047a52a0bfeba1210fbdfec4
  • SHA512 35bf2fa4bb1c32edc9a38d3804cda6c48c268e5db049a1e1bfc1508691c19948f6114974f6b980860cb8aa07770ba6628d38427d945581c6cdb1ef13c1039297
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4rSi0ynzuOPIbzjbggXjiUxrwyQq0BDZ0x:8uUIpT4vAj2/SVh3b3bHX+6rwyod0x
  • TLSH
    T1AC232A003BE9C13BF2BE4F78A8F26145867EE5633603D54A1CC451DB5623BC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2