Extracted

• • Target
    8e9adf6ac818e8afb4d14944468d3b511b7ee7231ea51f5d9566e83e9fdb0ab0
  • Size 45KB
  • SHA256 8e9adf6ac818e8afb4d14944468d3b511b7ee7231ea51f5d9566e83e9fdb0ab0
  • MD5 ccde59c814065caa09e87e61d412533a
  • SHA1 0f29d35c865e114ba7fec05e7392d13dc40c8ac7
  • SHA512 521d4370808e5b700b22fbb8f59e7478b6afbcd63264c81a7e50bcb4013b68e0995ba4451eddbf3c7035c8d40b66cfff9e110550f05eaea53702e5d6ca864675
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1nLiE0yFjrdj3kk8PIhrjbSgX3i1YWFa9OW4msKBDo:wuZ8pT1tc2KLBXDBh/bVXS1YT4mDdMx
  • TLSH
    T1C2232C003BE9812BF2BE4B74A9F26145467AF5633603D64E1CC451DB5B23FC68A43AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2