Extracted

• • Target
    8e1549aac8f632fb9308b1803d7d122011a66c99bc52546fde50690943dbeb4e
  • Size 45KB
  • SHA256 8e1549aac8f632fb9308b1803d7d122011a66c99bc52546fde50690943dbeb4e
  • MD5 3e8dce27de4a6aa90dea725c6a737a3d
  • SHA1 1d99e88a128a02d97c8a57dad7a8d1d541fc7e15
  • SHA512 5e2385cbe573747e2e134f825117953feaeb79c9bb5129ad87ebbc8ad095a97b0c30ad809dd2e664cfd27047055295b8241ab84f2c82aa6bca0290efd6885918
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9b9YikqHztOPIUzjbDgM3i7BLVF4Ky2d47EpBDZsx:EufspTf2g2WalK3U3bcMSho2dyE3dsx
  • TLSH
    T158232A003BE8C12BF2BE4F7899F26205457AF2A73603D64A1CC451DB5623FC69A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2