Extracted

• • Target
    8f6c83c19cd313ecdd569ce76e76aef9d10d5cda222e40971627dce37ec47d4d
  • Size 45KB
  • SHA256 8f6c83c19cd313ecdd569ce76e76aef9d10d5cda222e40971627dce37ec47d4d
  • MD5 f01033b5dd12f60d1ceb796306bf8662
  • SHA1 3b26bd7e64ec7b4e8823dd3cfc8bf62323fa94c4
  • SHA512 97848158790cce992edf6e17ea5b6809b9dea54587b89604b83eccbdb1cf293b06a7a54390e58383659c90733d31d20eb6e676896dd9912822bd2d9ed80188c9
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4oOao4iqCNjPIRzjbUgX3OwFlRWfFLfOxygFW1Qvu:8uUIpT4vAj28OabCKR3b7X+GlRWtrOxm
  • TLSH
    T179233B103BE8812BF2BF5F7899F26145867AF2633603D54A2CC451DB4613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2