Extracted

• • Target
    c8731d3d73566a1aa33aa895f8d8404c1368881ef19ca06b0e4d6373210e0f83
  • Size 45KB
  • SHA256 c8731d3d73566a1aa33aa895f8d8404c1368881ef19ca06b0e4d6373210e0f83
  • MD5 6c474ed9786d29dc9de6e8b1c11bc07f
  • SHA1 140d481c55d1b54573f1c0a2b485636812700672
  • SHA512 e701b6a96096c7eeb6221d388b287cc3ebf1cec2f430959ddc759c0d9d729e1b5b5875b7d18d5401069678f44bd52327d89dd80d8f3c998a5565516d369153f6
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVe0ewtDcy0oiZPIHzjbygX3iE3Kb3Se9n6GBDZEx:MuBGJTPho2twRPiWH3b1XSaKb3HvdEx
  • TLSH
    T14C231A003BE8C12BF2BE4F78A9F26245867AF6632603D5491CC451DB5613BC6DA43AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2