Extracted

• • Target
    8db30a455647a07fc695638ef59843bdf2a83eee9d8b45eb03efee406411ef26
  • Size 45KB
  • SHA256 8db30a455647a07fc695638ef59843bdf2a83eee9d8b45eb03efee406411ef26
  • MD5 4c925ee21c62fc4f56e24114db79f12a
  • SHA1 2bb90b2bd772487dacee506d4b12851f2c08fa7b
  • SHA512 aa1d570ea91a1ac4ff5a845434c9958d3aaa5b15f398a59bc2e3d1ed538a2ba422917e3f6ca83f86b5dffc4a473f439375810941a030e70e3bac34c893e6da2e
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAI0y3NPAIeiZPI2zjb5gk3i/CDYblCWWrLi6jBDZMx:kuSOpTPOP2e3V8iW23bWkSKDYbatldMx
  • TLSH
    T1D8232A003BE9812BF2BE4F78A8F26145867AF6673603E5491CC451CB5613FC69A436FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2