Extracted

• • Target
    c8405a0d30008ead1387896c70aba917dd085017d97f936d56986848dbc3bf37
  • Size 45KB
  • SHA256 c8405a0d30008ead1387896c70aba917dd085017d97f936d56986848dbc3bf37
  • MD5 8a3b22c6339423a6019973534c8ca990
  • SHA1 170e29920ae8211220b40d6e2279a7ac127d01d9
  • SHA512 b78905653f68f880ed6da44bbcec916c483bd3dee589516c3f730252d61ac124a3893c1d3c1f5fba076d142ac51ee1455c6fc7b1b7a14aa1491a3a32d0857275
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1A0ewnKcqeSiZPIrzjboRgX3ig9WcR2V2n6BDZMx:wuZ8pT1tc2DwKniWr3b3XSg4xV2kdMx
  • TLSH
    T16D232A0037E8812BF2BE5F7859F26245867AF6676603D5491CC441DB5B23FC68A03AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2