Extracted

• • Target
    8866b7b3c872763c68da3a061d82f340d22648484602a2ee598e474628c699d4
  • Size 45KB
  • SHA256 8866b7b3c872763c68da3a061d82f340d22648484602a2ee598e474628c699d4
  • MD5 e5b83d2a75e6ca202d3d80428d8bb839
  • SHA1 1cccb5762fb908dc520401072d7726248c237c1a
  • SHA512 cee2cd3e1a6c864f74981cd38f2dc9de2640b145db31bf9400db2eeac1a74d1809853d8a2441f721dd1fa8031a964eed51fbd276aec65393dfda4e083a120ee2
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVe8V1yp7EcPIpzjb1gX3iBrIf6Ia34BBDZEx:MuBGJTPho2t8V41Ehp3bSXSBEBa4/dEx
  • TLSH
    T180232A003BE8822BF2BE4F789DF26145867AF2673603D6491CC451DB5613FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2