Extracted

• • Target
    f8cd63069cb30a4e17f16585953c5e4ba188a1b8a4e76c5e7ad5691e09706e3f
  • Size 45KB
  • SHA256 f8cd63069cb30a4e17f16585953c5e4ba188a1b8a4e76c5e7ad5691e09706e3f
  • MD5 abd90f537591e1f87d8951662b08c959
  • SHA1 4157b88b84ae271c487af475a8fa21786a926d57
  • SHA512 3e91da33d1bf355f8976acab7ad326eeb4918128c0e6a53981443a59d407ccf85569bea8114f3dc1b20f7c6aac161cf1d5973954b0107aeae181cfcb25c3e529
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFylsHoPEaMPIGAjb5gX3imKPZmu+jbHleZBDZEx:MuLAZTnbg2XuuEaxGobWXSxPYuFHdEx
  • TLSH
    T1832319003BE8812BF2BE4F78ACF26145467EF6672603D5491CC4519B5B13FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2