Extracted

• • Target
    8ff45b1bf9fb18b9dd3428a3aae3e0b61e436da4a3a18e82a7693e8c8bc724ee
  • Size 45KB
  • SHA256 8ff45b1bf9fb18b9dd3428a3aae3e0b61e436da4a3a18e82a7693e8c8bc724ee
  • MD5 25612fd443b190f97183ec97c357dee6
  • SHA1 bd48393a47f4f399113634dd1fe0872e520a0487
  • SHA512 4ceacb595a9192866b1a77b4c9f4e546112262b75cd9d61ef3c3e49ae7bb37b876fb6a9138d7a7edd0497cfbcec52c13094e408d0c15755b252b89768b9e2c1a
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q94ZftDMgPIOyjbngX3i2nyznSVvLGxyBDZ8x:0u1YJTHcw2RVEOebgXSrSVvCxMd8x
  • TLSH
    T14A231A003BE8812BF2BE5F7899F26145867AF1673603D68E1CC411DB5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2