Extracted

• • Target
    8e9b2088014833676373ace86a9f7655e2d92f5b5008ae85890973d9ea1ec38f
  • Size 45KB
  • SHA256 8e9b2088014833676373ace86a9f7655e2d92f5b5008ae85890973d9ea1ec38f
  • MD5 4a0b5a8723242a53da6d50e03eeff7e8
  • SHA1 9b7b08908fb803d1b3e1a647ef95ebd11bb87650
  • SHA512 07e132ee366c6d06435f99c51cbe94204a7c4e563967e69d6330bb794080eeba5024ad30f4fb14207ad8f6890ab6576b4d323dbfb6c808d7dc5ced1913d11b79
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qA810CnMQRPn98PIQcjbvgX3iPOaxJHzLaAegwi6R6Da:kuSOpTPOP2MtnbvBQsbYXSPO6rY4RdMx
  • TLSH
    T16C231B003BE8812BF2BF4F7859F26245867AF5637603D64A1C8441DB5A23FC59A436FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2