Extracted

• • Target
    8ceb2ace970c4ba9afee691aab4181caaae783fc1205bdaa8160f3331cd4c3f5
  • Size 45KB
  • SHA256 8ceb2ace970c4ba9afee691aab4181caaae783fc1205bdaa8160f3331cd4c3f5
  • MD5 df89e978e772183d4d94bbcc7089b46a
  • SHA1 03be19846a26f5211f1cf983622cae0689038ce2
  • SHA512 b9a038cb14e41b6461df98c8617a70660835d874cae9b45b1f8ff83f57e133c044e9a6e10bdfedf388f819e8ed9ec0e3ab46795fa00ad7d4fa57dec7bae73344
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qABw0QUKXPIhzjbcgX3iqNkAGsHuVM5O6h2BDZcx:UuKWgSJTwRf2Zfh3bzXSQkAf6pdcx
  • TLSH
    T1422329003BE8813AF2BE4FB4ACF26145867AF5636603D5896CC411DB5623FC6C6426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2