Extracted

• • Target
    8c83029fdea65ebdbf0830b4be8f03ba715108565339ca5fa897fc1831c9b0cc
  • Size 45KB
  • SHA256 8c83029fdea65ebdbf0830b4be8f03ba715108565339ca5fa897fc1831c9b0cc
  • MD5 7e851b0e66bb007daba1cb9477ce0fea
  • SHA1 31df82c2c50a0efbefacd00ee5ddda042daa503e
  • SHA512 08d1575c2091c4cae6f1bcae16965bf759d27da080ecc7a4953aaacf4ddbc967171eb5d9260bca0522ce00595e24c51c5df998b7bbb5760019a9df9d0b2e01d6
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1ZxJaxMwHuPIvzjbbgy3iT91WyavMQlS7Z4pVQBDZe:RuxkJTgip2weN3v3bkySB1Vqa47Gdcx
  • TLSH
    T176233C003BE9822BF2BE4F78A9F26105467AF2637603D5492CC451DB5723FC69A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2