Extracted

• • Target
    8f42ff293f2a38c1333b084262cb11129823abfc81e7e94c9cda968861e95958
  • Size 45KB
  • SHA256 8f42ff293f2a38c1333b084262cb11129823abfc81e7e94c9cda968861e95958
  • MD5 b097d133205af21a45d444cef683eebb
  • SHA1 91c2cd21e6e79717b0738e48e900116a9be50c4d
  • SHA512 991341a24541d3c611f0d466386f724bf607573542232b2e7a1d7975b3f436ff4f9e07eaadbbfbb4caafb2091c75433646f6400dff5925b47c10eecfc9e06717
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVe0ewtDc30oiZPI/zjbYgX3iB0Cau0AFXqlNBDZEx:MuBGJTPho2twR2iW/3bPXSVXCDdEx
  • TLSH
    T157232A003BE9812BF2BE4F7869F26145867EF6636603D5491CC441DB5713FC69A02AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2