Extracted

• • Target
    8aeaa3e670ad9151a9081b7e3b56a253ee00c0cb3e15a11f162afb0e62407e40
  • Size 45KB
  • SHA256 8aeaa3e670ad9151a9081b7e3b56a253ee00c0cb3e15a11f162afb0e62407e40
  • MD5 cfc65f773a3ade345e2736c788967b6f
  • SHA1 41b7d3d08d5d78bd8b5099b732b584e556ce3e18
  • SHA512 867bf4d0230ae7969bd72f7691037d2fa003c54390641f21cbaef9318461b363a9f6d415cdfedd9e6f9743d4bc61fbb5eb2eed38160e068d1c5aafaf1b34a84e
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4zS7synzuOPIzzjb/gXwionRvH0WkPIBDZ0x:8uUIpT4vAj2nSYh3z3bIXNQvH03ud0x
  • TLSH
    T148232B0037E8C22BF2BE4F7899F26145867AF6633603D54A1CC452975623FC6CA52AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2