Extracted

• • Target
    8c16d5a867c2a168234d2eac2c0e1901bfaa4952c5657ccfe23d13e1d967af3d
  • Size 45KB
  • SHA256 8c16d5a867c2a168234d2eac2c0e1901bfaa4952c5657ccfe23d13e1d967af3d
  • MD5 454c8295b65e13a73f9097b9fa24e88f
  • SHA1 cdb1c95254a25e72206f0e503e015a540c6206fd
  • SHA512 4fcc64fe79b59db999f47094c810d3452b9da1d84e2e8f344e0a53d8f8cf22b8c2527583a5d17b97a64488d201d4ca816fa37c4269db060e31a51c2f4e4f5008
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFM3HO4SjeOPI0rzjbZgQ3ixKhbgvpfIJPZvBDZEx:MuLAZTnbg2N+He30r3b2QS4OvpghZZdG
  • TLSH
    T1CF232A003BEC8127F2BE4FB8A9F26145467AF6A32603D68D1CC4519B5B13FC696426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2