Extracted

• • Target
    8b0638a6a62fe8b5f0f7b0177af9536ed62247cbdaba070abaf28a916f045eec
  • Size 45KB
  • SHA256 8b0638a6a62fe8b5f0f7b0177af9536ed62247cbdaba070abaf28a916f045eec
  • MD5 0e49ee98a6f7b8328b665404deef1d10
  • SHA1 3035ac7f58a9d95a06bcf305ea6d6d9f997ebe82
  • SHA512 d90c432d9c0fb4d304260443c74abe0d32bcfa9ed90c74d306be041293a34882d5a580d70aac245f8b13831ef10bae24be8c5812dc7eb28a426136c67a60e7b6
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1910CnMQRPn98PIQGjbZgX3ic+U5OMRXxoXriSBDZUx:cuR0JTPjY2ktnbvBQqb2XScx5fxxyr10
  • TLSH
    T160232A0037EC812BF2BE4F7869F22245867AF6736603D64A1C8451DB5613FC6DA436EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2