Extracted

• • Target
    e8ddca559740a5fca92f32f9e30c4cfb350536b254f9e2c848e431fb042ffe68
  • Size 45KB
  • SHA256 e8ddca559740a5fca92f32f9e30c4cfb350536b254f9e2c848e431fb042ffe68
  • MD5 737f37b7b3a90e23d1b8d2d4fa2df17f
  • SHA1 22a218e393dd7f8ff3c55d064b1b1ddbc75206ab
  • SHA512 3e991f9dce6b11c742f983ba848fd1cb3b3783145253b1fe7c932f86667f1f8f956761e659e4d9d82e0bbd289161a3fdea38c5264fe91b74dc3df41bfd121dee
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1/VlcVl6GcPI+zjbEgX3cwafNDV145WTbu0LBDZMx:wuZ8pT1tc2OV2X6Gh+3bLXMxj145WTJ8
  • TLSH
    T176231A0037E9822BF2BE4FB8A9F26145867EF6632603D5491CC451DB5723FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2