Extracted

• • Target
    8bd8f37b3512a09ccee540c506b7b27a080a3ab26958db905eea11f390f01b29
  • Size 45KB
  • SHA256 8bd8f37b3512a09ccee540c506b7b27a080a3ab26958db905eea11f390f01b29
  • MD5 99cb366db00895478910530e70e581d9
  • SHA1 f9803565d187a426bc3a1e50a9d15d2c34158aa4
  • SHA512 0e7bfe534dacf56018025b5950b044f729b287c793de6fbc5eaec4e418afe689868f07915b2f8c4dfe1deece5a24de01693dd25079c892b32d0b739202b0284a
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9voopCBK9INJPIZzjbugX3i9c11mnLaBDZ8x:0uPrpT/qY2ao6bIwZ3bRXS90snId8x
  • TLSH
    T147233C003BE8812AF2BE5F74ADF25145867AF6633603D54D1CC452DB5613FC29A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2