Extracted

• • Target
    08c67093117d7a4817b5c35b2ca782bb24bfadd35501cc629b7d64dc236a057b
  • Size 45KB
  • SHA256 08c67093117d7a4817b5c35b2ca782bb24bfadd35501cc629b7d64dc236a057b
  • MD5 298021c7cecd904f8ef6bdf29e12908a
  • SHA1 0688d7aafc9031329fa6ab6819ba48a87faa2322
  • SHA512 7fc895eebb20075c68f2fd468979068bf280e341293e4ba329d67031dc9d148c4ff4e323f8aba2d4091ca403a81600ee91c44a6e3f7b773f89059c1abd1e51ec
  • SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qjL9YikqHztOPIUzjbpga3iNnvBnBo6SaCxLSjnBDZ+:0u2vpTDe+2walK3U3bmaSNnvBBxSag4M
  • TLSH
    T13B231A003BE9C12BF2BE4FB499F26105867AF5632603D6491CC452DB5713BC6CA52AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2