Extracted

• • Target
    8a2422227b4443ea643c330d2bcc75ecb60b437aab74a9e9089f7e1a738b4930
  • Size 45KB
  • SHA256 8a2422227b4443ea643c330d2bcc75ecb60b437aab74a9e9089f7e1a738b4930
  • MD5 8ccc766277c827017a06c5f4c968e852
  • SHA1 6914672076ae9ef6dd95e9d730b06179a5531680
  • SHA512 8fb13711a6294c71470f0a920d913e59f33689da413ccd7f5cc102f9a68fc9aead927e87c9bf1c276b6712bda43b981aa40889f83fee2b520188ef2ed4a9e132
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1WBz3QKx7PIaDjbQgX3iAeRcfbGoQBDZcx:RuxkJTgip2HV0anbXXSdkcdcx
  • TLSH
    T1BB231A003BE9823BF2BF4B7898F26145467AF6632603D54D2CC452DB5623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2