Extracted

• • Target
    8923e5f001aaff30c1f3df1fc3fb63b5ff8ff15c09232ff0f3ef787a13f57de0
  • Size 45KB
  • SHA256 8923e5f001aaff30c1f3df1fc3fb63b5ff8ff15c09232ff0f3ef787a13f57de0
  • MD5 9e43cfb539cf93b0af0dda4405d0ed2c
  • SHA1 8c6b8e3a74552b64213489cc665fe3f60150e652
  • SHA512 6c6774bd8a479c816df0ccc8d27acb26727aedb9830c8df557b374aded542fa18f07e7b9007ccc0c141cf3c48e4dbdbb93d6464a8c44315c53fa43d7a0c884d7
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYP58SIkOPILzjbRg83iwOJIWSlICCx1uBDZ0x:8uuSpTgyf2ZNF3L3be8ShPSljCMd0x
  • TLSH
    T165233B0037E8822BF2BE4FB89DE26145867AF5673603E58E1CC441DB5623FC696426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2