Extracted

• • Target
    8b8800a25288d70e719ed0d2989787a325ef3fb65a2fa66b4d39740831d75fdb
  • Size 45KB
  • SHA256 8b8800a25288d70e719ed0d2989787a325ef3fb65a2fa66b4d39740831d75fdb
  • MD5 ed78fe56f3c8646ee7fff1602c72030f
  • SHA1 f242d33a80fb22a102d917b3ff62ef958e0b5803
  • SHA512 660f609c604f1bb179fb936317358641305c0f6a1da5a3367302cdb35b87a7890a6c43a2349491d06a9e9f9fc6916c85c5420a39b56e9dd0d62f315fd090e5be
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9vK1YJTOPIxnzjb5gm3ioB8ZiL9nxtBDZsx:EulCJTHl42HiZ3xn3bWmSeIiBnxjdsx
  • TLSH
    T111230A003BE8822BF2BF4F78ACF26145467AF5673603D58A1CC451DA5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2