Extracted

• • Target
    8b1aac09c36f9f8276e81650bf1acd9b9ab791b9c12afed76c314d43bce09536
  • Size 45KB
  • SHA256 8b1aac09c36f9f8276e81650bf1acd9b9ab791b9c12afed76c314d43bce09536
  • MD5 4f4d4a6280953342097b5554148ff75c
  • SHA1 061320aac6ec63eeb979d031aea8631aca0a41d4
  • SHA512 a24fd7bbc8b25c9d91cbc239ef94c0c5869e8a79b47d7125293b932601ba84e9cc798ccf1a808234db76ff83568826cb2e72229fa21ea49ae4ef8efbfd0d1d94
  • SSDEEP 768:cuqb5TrIGuCWUoKXMmo2qQq3xq6YFoOPIUzjb4g/3iH0heQKCZXySBDZUx:cuqb5TrhG2ekxo3U3bv/S2eQpZ1dUx
  • TLSH
    T1E7231A003BE8812BF2BE4F7899F26145867AF6637603D54D1CC452DB5713FC68A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2