Extracted

• • Target
    8d3f92a8659a51fe16b693743cbe4e6dee4d46f278687d3b48cad3752409b147
  • Size 45KB
  • SHA256 8d3f92a8659a51fe16b693743cbe4e6dee4d46f278687d3b48cad3752409b147
  • MD5 a8af9590141c265b30bc62857f946ad2
  • SHA1 cf501f6c07f7b944d6c21e132ed4c8762d9ad094
  • SHA512 1e797e4ad51fc9561121c3bf5ec34b7defccc8a8fa70e9a4354bdd493569147fc23e2270a238c47b5435dcd8fbeaf6f02d5a8ce7c9e91a5a15f384d4331035b8
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q98wD/y/aqPI1zjbugX3iPMpBmtmcrBDZsx:EufspTf2g23kh13bRXS0pB0mc9dsx
  • TLSH
    T17F232A003BE9C12BF2BF4B7899F22145867AF6632A03D64D1CC451DB5713FC68A526EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2