Extracted

• • Target
    8b60fa75ec74909328d051a28d0148e13e4b0e1835ba2b2f2958dd091e9179a3
  • Size 45KB
  • SHA256 8b60fa75ec74909328d051a28d0148e13e4b0e1835ba2b2f2958dd091e9179a3
  • MD5 7b6efd1026fb0811cdbfe7bba1eb1e57
  • SHA1 278ad66a486e1bdba3e0afc3962a16302e2fc91c
  • SHA512 5588b71c3cdd94fee868d107ae64eeedefc826a0f44d5f45edd22c2955bd91f2e3e7279d2a64abd9047f0e0835b036196b0ae07fe9db89cf07f433a5462db37f
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlN3xY6AZOOPILzjbGgZ3iR3V5Ab/6BK6r0X2gBDo:wuDWZTpMZSB2MulO3L3bZZSR3S6BKDR8
  • TLSH
    T1AF231A003BE8812BF2BE4F7898F26145867AF6B73603D54A1CC451DB5723BC686526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2