Extracted

• • Target
    8ca79cae13a41939eccb9be88ca2aa9ecee518cbec86b1685ca71f6c965e908d
  • Size 45KB
  • SHA256 8ca79cae13a41939eccb9be88ca2aa9ecee518cbec86b1685ca71f6c965e908d
  • MD5 44b71ce7b88c6a97c3098c2d979f6f5f
  • SHA1 408a5c06c2907b1d64e40d2c00c943c4c1d700f3
  • SHA512 2db8b97f8939c2a865ea5272b7080c3cc77a3065f5713eb55532b236f92b00d495a8c80762bf8246821090e63b4c5f022d9ca15030b57b43d7ccbd5c83386262
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2ql43Fo9EaOPIzzjbSgX3i+l9wT5zFzUTpHBDZMx:wuDWZTpMZSB2J8Ea3z3bVXS+l9O5zVUY
  • TLSH
    T1FB2319003BE9C22BF2BE4F785DF261454A7AF5A33603D6492CC442D75613BC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2