Extracted

• • Target
    8bd2cf80dced016a880b46e547b574ec97da285201b532a69225054e0e62fee2
  • Size 45KB
  • SHA256 8bd2cf80dced016a880b46e547b574ec97da285201b532a69225054e0e62fee2
  • MD5 ead351c4eb67cfcddeae4115958d70c4
  • SHA1 6f5b1d3c6da56cd3a4ea578f8b677afa4c5ef365
  • SHA512 4a86cb3cdeeced851214009cb577c14febad4e3e88ac26c2d0f0841551bfda771b4a5d4c442be66d38d81c2a1cd0a662d1798be6422e82c2e191d84bd601e072
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1fQ0u3+/vPPjZPI3zjbrgK3i2xAJorlm2DtBDZMx:wuZ8pT1tc2Qi32/jW33bUKSp6jdMx
  • TLSH
    T159233B003BE9812BF2BE4F786DF25145867AF6633603D5491CC451DB5623FC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2