Extracted

• • Target
    8a568629cf7af4fc2bb324dc183d82e9f9fc16e70b36dc08ff4035a700843cfa
  • Size 45KB
  • SHA256 8a568629cf7af4fc2bb324dc183d82e9f9fc16e70b36dc08ff4035a700843cfa
  • MD5 c65d069f866863dbc60f8bcf9dcf053c
  • SHA1 60ea1dbf3b43440da99a70c6817fdd5b5482d668
  • SHA512 0cba5566600e669cf34b8cfda17c43064f9d271ffca0b9703a9db7a1af4a7584e4932513fed3d42a8f8d783a23a3a4817f64f500add5362b4c09505755d4dca5
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVp8V1QpfEcPIYzjboOgX3i0OsSsGuUSQVBDZEx:MuBGJTPho2y8ViBEhY3boxXS0ZJOdEx
  • TLSH
    T1CB232A0037E9822BF2BE4F7899F26145867AF2633603D64A1CC451DB5723FC696426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2