Extracted

• • Target
    8defc65191294317edb08cc04ccaba6d4652a273a36beb830159b39a2bfaadd7
  • Size 45KB
  • SHA256 8defc65191294317edb08cc04ccaba6d4652a273a36beb830159b39a2bfaadd7
  • MD5 f6b7d97c8ca1dbae8801f67166ae07b7
  • SHA1 b074c6c82932b83a1f48bf8846f81a760f1a2fb8
  • SHA512 b774e4da2f7d7521806ac57fadbf18965aa13b39261f3b05964b0e3b28de13b4e8a16ad515c759f79c61dc7fcba1f9ca8e919c6d55c2d9147e4bdeb1b3c64a9f
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1WT9Qpm9PIRzjbfgX3iFzm7sb6hHhBDZcx:RuxkJTgip2BQR3boXSM746h/dcx
  • TLSH
    T189231B003BE9812BF27E4FB8ADF26145467AF2636603D54D2CC452D75623FC68A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2