Extracted

• • Target
    8f3434b5d13fa88e970ef19da4ac9cd65712037ab7c4df3c759cb43d8cf631f6
  • Size 45KB
  • SHA256 8f3434b5d13fa88e970ef19da4ac9cd65712037ab7c4df3c759cb43d8cf631f6
  • MD5 cf4807e247c0fbff14eef2a2b4d949b5
  • SHA1 140b06c12e6d68015489814b49a92a844e0a309d
  • SHA512 161ddfaebc4eb72b8cfb13db8cd3c73377e0fc7cb0127e562faf0a86fac79b14740c3e3684eb0f2cc9490dbda927e3d57be176e3391bdcce0c50fb10393ab22b
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9zzjHy/aKPIbVjbWgX3iTxKS6LKl6FBDZ8x:0uPrpT/qY2Qnhb9bJXSF6Kl6Ld8x
  • TLSH
    T173233A003BE8C127F2BF5F7899F22145467AF6632A03D64A1CC4119B5713FC69A52AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2