Extracted

• • Target
    8917558024fc4f1bb4409debff62e99943ff676c31661e076d9c99934e3b8672
  • Size 45KB
  • SHA256 8917558024fc4f1bb4409debff62e99943ff676c31661e076d9c99934e3b8672
  • MD5 dceffe89e3988963da11d298d7183c7d
  • SHA1 9195aec04f7f41d9d5fdcb0a885d8da01cb698a7
  • SHA512 d86e170ca5d1081fbcea71d1dbf0c8a15b1e6d78aca356ae2906f0735962b47cb40edb4ff3ef311e2d878b3f55519b51d92ba73dda685e2ea70a04168623894b
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9tgzBNMwpGPIMszjbbgX3tHr9DHUwv21lBDZ8x:0u1YJTHcw2ymGYvMs3bkX9H9Uwv21rd+
  • TLSH
    T153232A003BE8822BF2BE4F7898F26145867AF6673A03D54A1CC451DB5713FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2