Extracted

• • Target
    a8a212515b235229f7769a2b5f23507efb9b7b1a995943446d4f16099fe4ab3e
  • Size 45KB
  • SHA256 a8a212515b235229f7769a2b5f23507efb9b7b1a995943446d4f16099fe4ab3e
  • MD5 b5faedaa06d45ee48859b40f1e678427
  • SHA1 27270b1f50a0ccf88bdbea7047778e2323c226af
  • SHA512 9c64878d01413b10caf4748c903265a3a798ee2ee378e7d91127530df0c27a749445355abe145be38835799da639f162bc25c33cea65d0f7a7dc33d56359666c
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYrZoyTM4PIXAjbrgX3i6ZzVgl+R8nlfzBDZ0x:8uuSpTgyf2th0XobUXS6Xglu0ZVd0x
  • TLSH
    T158232A0037EDC12BF2BE5F78A8F26145867AF6633603D54E1CC451DB5613BC68A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2