Extracted

• • Target
    8d7782d0a8b57238eedf8ca61dfbdf5851de71728d2c780c5f080b768db2dcdc
  • Size 45KB
  • SHA256 8d7782d0a8b57238eedf8ca61dfbdf5851de71728d2c780c5f080b768db2dcdc
  • MD5 f142b1b004880deecf40facc34cead4d
  • SHA1 5d167fa04c1d64fdd5c126c75491b4fb9ce96e63
  • SHA512 ecf24c50f56704b1c49bf17e0b27ac5a0f8a10a53e7ad2f62da926875c2b8542ed1d3bd2a71b6f64ec96033876c4a1be8957c541fec68199046d6732df2d1924
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9T9oSsqHz1OPIqzjbXgq3ipHl29iGS9BZNHCUBDZsx:EufspTf2g2OKti3q3bwqSpF29iGgUidu
  • TLSH
    T1D0232B003BE9C13BF2BE5F78A8F26145867AA6733603D54A1CC451DB5723BC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2