Extracted

• • Target
    8eca323912cfcfa042950b653c6c2e1c5ff7e0b4d54b7f8b631c58e953d383d1
  • Size 45KB
  • SHA256 8eca323912cfcfa042950b653c6c2e1c5ff7e0b4d54b7f8b631c58e953d383d1
  • MD5 bce216d1cb9bf2eef1f6d2ae4b6b8654
  • SHA1 86db9cdbb9bb4e6d462c93ed8754ae6b6e1e7e57
  • SHA512 e3c67be173a34d77837b5ba49040da47d28048620656a3af0398d214344d94179ef651e583f24e523a5cdba793df6f606819fb2cba28da16ae4fa699301c1612
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1IBz3QKx7PIQKjb9gX3iFsoMyQJcRqyo2oG/BDZW:cu6YepTPso2NV0QGbqXSFsrR5x2oGJdW
  • TLSH
    T152230A003BE8C13AF2BE4F7898F26145867AF2633603D9496CC451DB5623FC59A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2