Extracted

• • Target
    b8a737c5fb78ec643db27f8f463018e2b5ce04d2b297763ac12bed5c3b718318
  • Size 45KB
  • SHA256 b8a737c5fb78ec643db27f8f463018e2b5ce04d2b297763ac12bed5c3b718318
  • MD5 9a06f8e56b71d7f9350d823f381b3b50
  • SHA1 93bfbca8923948e6dc6d1314bf8c08ac724c239e
  • SHA512 dc4af57864a8420bd5a5668ad9ae64bf41e376badb533603b642910ecad97df40659662c1ff791a136335bcda0681e96baa4fe19d15fc4218f93b680756691d8
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1K8V1QpfEcPIYzjbygX3i5h/wEUou33wti8BDZMx:wuZ8pT1tc2x8ViBEhY3b1XS5hSouQti9
  • TLSH
    T1BF231B003BE9C22BF2BE5F7898F26146867AF2633603D64D1CC4519B5613FC68642AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2