Extracted

• • Target
    08c1cfea2ba8549f04d482e4107a4f59f46c5fcdd4d753015ab532ea9db2eee0
  • Size 45KB
  • SHA256 08c1cfea2ba8549f04d482e4107a4f59f46c5fcdd4d753015ab532ea9db2eee0
  • MD5 7d09d502943a3c7fe51b7b530427bcfd
  • SHA1 6eed759d771e7858d9aaf89d1dc132af49a9d94c
  • SHA512 dcb4b7bc560e17c93e52c6592d6383d3bb483a320a3889517c5e766083ccf0b229a1b797d5055df4b4a89c40ee88ef465b246f2725bea02ccdd48eb95843b014
  • SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7J6R8aI6OPIXzjb+gd3ia+CXe05v52k2kEe6SBDZ+:0ushJTDXgH2o+Fb3X3bBdSa+CXDvOkET
  • TLSH
    T132233B003BE8C22BF2BE4F78A9F26245867EF2672603D5491CC451DB5613FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2