Extracted

• • Target
    8db2a1116d68cd295730b84e46e3249773e5be323cf68382e83e1faab8d51feb
  • Size 45KB
  • SHA256 8db2a1116d68cd295730b84e46e3249773e5be323cf68382e83e1faab8d51feb
  • MD5 eab2ff5f491dd17a1502366e019701f2
  • SHA1 794e269b88850b648739fd0e54e345db5e3f7bee
  • SHA512 7d5c62db0729fd0f935935a51eb8318e25f7f5a2d217d874e8510bd3876e73b8528140c8cc165e63fab6360a78309ca191588bb26532c7e510ec297bacfb693b
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAmxGQG9PHuPIczjbXgC3iP93HXCypH1VdBDZcx:UuKWgSJTwRf22HC3c3bwCSP933HVVzde
  • TLSH
    T186231A103BE8C12BF2BE4F7899F26145467AF2633603D6492CC451DB5623FC6DA426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2