Extracted

• • Target
    8d7873681d320d18747e5feda5ead7fe0a6ff42d4d7972907396ba32634f1c19
  • Size 45KB
  • SHA256 8d7873681d320d18747e5feda5ead7fe0a6ff42d4d7972907396ba32634f1c19
  • MD5 e67f1ee7b4834188b3c20b3dcbc03720
  • SHA1 3b39a983e949eb64a4f66db7ab6f08ebea7363b0
  • SHA512 155b7d89f37e2afd55454ce2d4b9e4d2eb6479e121f0bd8108beeec0e6614faad692116d1c9af857d025cc6dc3567a434c02335b8d75997581e614768013f017
  • SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qACLiE02FjrdjYkk8PI1AjbngX3i2YXMDkNbnlaBDg:cuqNJTLr62yL9XQB1obgXS2gaknEdUx
  • TLSH
    T142231B003BE98127E1BE4B78A9F26245867AF6732603D54E1CC451DB5723FC68A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2