Extracted

• • Target
    a8c1f632bd75b137bb32f011886a21d9562dee2d06dafd627db78f1f3dbcd545
  • Size 45KB
  • SHA256 a8c1f632bd75b137bb32f011886a21d9562dee2d06dafd627db78f1f3dbcd545
  • MD5 bb01f020d9cfced3863d94d669e996fd
  • SHA1 8bc4bc25e15bc9ba0b9a3a3a270f178b69249827
  • SHA512 4a57e6a8ee48983062ef79d630c8366d78154dc3dcebb165ff86a033215a5469e9147b6526fb54543d51aba43b4577ccf2e459e501d9bc1d5163158cac616d8e
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAI0e3+Kv18iZPIezjbwgX3izIqXuyx0pOh10X2xBDZO:kuSOpTPOP263T6iWe3b3XSzIqXuyxAmY
  • TLSH
    T15A233B0037E9812BF2BE4F78A8F26145867AF6636603D54D1CC451DB5613FC68A436FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2