Extracted

• • Target
    d8f7f366aea6069ba8f12c28a576452715ce5fc868e0109680579a842823c564
  • Size 45KB
  • SHA256 d8f7f366aea6069ba8f12c28a576452715ce5fc868e0109680579a842823c564
  • MD5 8c8d1517e9ecb809f675fcee7f24e5a8
  • SHA1 f3914856af9394bdd98f939d79b9fc5949ee78bc
  • SHA512 43f8c5342662eb23cd8d14c2f0ec5528a63dd5dc92de83f9b8e90b5fd33554712248700eb41dc318dcbc201011b538bab76958ee43789650c3e53b23792f9fdb
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAAxJaxjwHuPI+zjbqgx3iw/Kh9nIPnz7LBDZcx:UuKWgSJTwRf2Qe+3+3b9xSwiEHddcx
  • TLSH
    T149232B103BE8C12AF2BE5FB898F26145457AF2737603D6492CC4519B5623FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2