Extracted

• • Target
    8a6a8091c9bd6f85a24e1b165c586ba69b94bdfaaf6bbaef8e16916f01b2d44b
  • Size 45KB
  • SHA256 8a6a8091c9bd6f85a24e1b165c586ba69b94bdfaaf6bbaef8e16916f01b2d44b
  • MD5 cae955a0b47c643df5459ec963321b6d
  • SHA1 0de36ab5c5309442e699d79ca0184041dd2cf1b9
  • SHA512 b4746d3f6ac92fbd15dfcf9052b1000560419432e0e032817dc981ae755787330147e840d05332682f59167589b8b5db3dda31d2a23e537d83c5f62ea047f49f
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1umaPcl83APITpzjbn+gX3ikzZcWDOrhgfVeh35rBs:RuxkJTgip2PfcS3lTp3bBXSQxqufVI9s
  • TLSH
    T167231A003BE9813BF2BE4F78A9F26145467AF2637603D64D1CC451DB4623BC68A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2