Extracted

• • Target
    8a2420630cec03810fce3c23f63923deb5dfcd9d5770adfbff80a86f60dfebd3
  • Size 45KB
  • SHA256 8a2420630cec03810fce3c23f63923deb5dfcd9d5770adfbff80a86f60dfebd3
  • MD5 bbc0eec36638411dfbda49b3b865f06e
  • SHA1 b113cf50f9f330d2bd10a6754cd9ebfa9ef2c599
  • SHA512 105db0aee46fbd9b6da0338d29a72adc5509874427263bca92cc862a10d06a3d7fe507dd61cc2e90f5af61fb386b9a7a08309fe213815eb9690399bd163bea8c
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1Jw0QbKXPI1zjbLgX3iULKtZmtzoyKrCY8BDZUx:cu6YepTPso22813b0XSU4EtzFKrWdUx
  • TLSH
    T1AB231A003BE8813BF2BE4FB89DF26145867AB6633603D54D2CC451DB5623BC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2