Extracted

• • Target
    8a58ce664b8d059165b86a6cba7ac6149e7da63369b886db4360b582a476097e
  • Size 45KB
  • SHA256 8a58ce664b8d059165b86a6cba7ac6149e7da63369b886db4360b582a476097e
  • MD5 f088b693a3aebfa7a4bf00bf6d070a48
  • SHA1 dcbb62780eba1217dd1d828a27a992f4ed6fdd04
  • SHA512 fb6a3f2ccbd00a763bd170778c87acac0e75977633a52d34b553d6ecf65ae1b657e9b8982484337c6575aa7ec733faa81db9463ed1b39a7d0c282a9aec262084
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVLVbIpeUGcPIOzjb2gX3eVwR+aWfhbZQBDZEx:MuBGJTPho2yVs4UGhO3bpXOeIaWfhbZh
  • TLSH
    T1ED231A003BE8812BF2BE4F78ADF26145867AF6633603D64E1CC4519B5613FC696426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2