Extracted

• • Target
    8a89a2b50502d49c724c11ddfda4759e3616536ef50b4fff588326ece9f05068
  • Size 45KB
  • SHA256 8a89a2b50502d49c724c11ddfda4759e3616536ef50b4fff588326ece9f05068
  • MD5 6db95442c60ffdcb181805cc1b3c8736
  • SHA1 00c03e5603322931cfc62582cc2843c43a567914
  • SHA512 e699a6ce03c982339e4af13875c742c83b4c3d4678b8dbed0f78a7cd7b5f3e0f23158144f040acc33dafa57abac66bdae89a50d336d5209fcd6f4abc29c6bd7a
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVE10CnMQRPn98PIQUjbPgX3iKYgv7GfOftCkvnBDZG:MuBGJTPho2dtnbvBQ0b4XS4Fft3vBdEx
  • TLSH
    T160231A0037E8812BF6BE4F7469F26145867EF6632603D64E1C8451DB5B13FC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2