Extracted

• • Target
    8ecfb96879e9c00a04a930f9539b14c20b10db1939fd0a66cd95d3f0d6c29e6c
  • Size 45KB
  • SHA256 8ecfb96879e9c00a04a930f9539b14c20b10db1939fd0a66cd95d3f0d6c29e6c
  • MD5 edb9d317b58688dd6272b06a9e03a8ef
  • SHA1 87d0e9278e94bb8468c4fb91b9042a6b96afdfc7
  • SHA512 f90edf26fc2c18510314f875189973a2a577001efc1a0ec4c08837e02431aaec795b82e99a0d42db165a6904b2d576a80be6267cade620f8023a151e19d7b45d
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1nLiE02FjMdjYkkmPIszjbagX3inLFv3tBDZMx:wuZ8pT1tc2KL9wQPs3bNXSRPjdMx
  • TLSH
    T1EA231A0037E9C12BF2BE4FB499F26105867AF6733603D54E1CC451DB5723BC68A42AEA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2