Extracted

• • Target
    8cbc7215e5818ec14ddc92f654b44cfbe941dbec7346597f79ef424e54378036
  • Size 45KB
  • SHA256 8cbc7215e5818ec14ddc92f654b44cfbe941dbec7346597f79ef424e54378036
  • MD5 b17914cc579b7cfb990a8099888d8698
  • SHA1 d9898d281462c9ae86e8bbe54efc27150fcb5973
  • SHA512 fb230ecde81616f79a5fe4319e621e1e46c928d4da6882a04307d12907ead0e2597591de39918e1c30db71b873b88b6e35ec43435c44c6f7219c1571463883ef
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNrzjHynaKPIsvjbggX3iXVdVgpgiqC9gdBDZ0x:5uSy6pTpoo2onZsbbHXSlwpgiLgzd0x
  • TLSH
    T136231B103BE9C12BF2BE4B789DF26145867AB6633A03D54D1CC411D75723FC68A42AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2