Extracted

• • Target
    8beac57df299373fd9e7d703a1e9c6f6e353da1cea7b145b880df216106815ef
  • Size 45KB
  • SHA256 8beac57df299373fd9e7d703a1e9c6f6e353da1cea7b145b880df216106815ef
  • MD5 5e0635d120a5a782a42470c53aba2623
  • SHA1 4b847e9201acf43edd4a076175f51a6d304f1b17
  • SHA512 17ae476336db0b1ac179707c31f631f3222fea6e1d61776ae9e36ecb354beca0699d68a82a46279d0d0052c4299857db49cdd306e5e1be0ef2b3907be44de185
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFP3Xo5EayPIEzjblgX3iG8c9TLSEViTYBDZEx:MuLAZTnbg2YQEabE3biXSiTL0CdEx
  • TLSH
    T1B9232A003BE8822BF2BE5F78ADF26145467EE5636603D6491CC401DB5713FC6DA42AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2