Extracted

• • Target
    8372d0f5071c12819480b9e8dd006f08a11865abbba61ae43fe5a47944525535
  • Size 45KB
  • SHA256 8372d0f5071c12819480b9e8dd006f08a11865abbba61ae43fe5a47944525535
  • MD5 1da09d4293579d79802f91f2f1f798d7
  • SHA1 5565c0e7b986135283a9c8cb236d11a4acf2c7dd
  • SHA512 b2d17af20fa8410e9240b0df7d237bafeade16b5cbbe8cc37a59d1bed4a4df47caad2757e49b0c6b5d684b7abff00fe6858c237acf576f59b3fe121be43f28ca
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1gTo0p54FcPIhzjbUgX3irJ/7yI8yBDZUx:cuR0JTPjY2bTDv4Fhh3b7XS5yedUx
  • TLSH
    T1E4233B0037F98137F2BE4F786CF26145867AE6632603D64A1CC452DB5623FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2