Extracted

• • Target
    a8b5bd8698c6b5bdd348277ec03a6bf69f0527daa1d8dd60fdfab2c24d7ea00b
  • Size 45KB
  • SHA256 a8b5bd8698c6b5bdd348277ec03a6bf69f0527daa1d8dd60fdfab2c24d7ea00b
  • MD5 599b8a3a889e10a38ccc57d76c9b32df
  • SHA1 a81e442b1f49ae6ddf7788d086e58a19d192e39b
  • SHA512 d1b1013b64f9b14f9aa129f554c47917fb5f63039397c3cf9b2949281e853abbd007c2312ee4f52138a3a02aa6d9055a00eb9ef423060f0c793086eb8ae47cf5
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9e/rLzlJAOPIc6zjbSgXhi2AmBWt3azP1BDZ8x:0u1YJTHcw2RPp23c63bVXwNmBWt3aXd+
  • TLSH
    T19B233C0037E8C22BF2BE4F749CF26145867AF6677603D58E1CC4519B4613FC69A42AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2