Extracted

• • Target
    b8cf0a670b7594c9a41ee0a3e2b59585a4203ef4b979c81e612c94a0b3c9598f
  • Size 45KB
  • SHA256 b8cf0a670b7594c9a41ee0a3e2b59585a4203ef4b979c81e612c94a0b3c9598f
  • MD5 173e7369f461ca3593a863830d5773f1
  • SHA1 f086795e6d3d1d1c35bcc9090623b310eb9de2f4
  • SHA512 042c4a14ab7864dd0be385498f624dc386bea3fc134350b81f9e09669f5e19bc669ff27161b15866f99717d359688e3d23c8a1f61676ee62dca1196a73ebf363
  • SSDEEP 768:cuqb5TrIGuCWUoKXMmo2qQol9fcBEahPIt6jbtgX3i+m+KZeZ1cqhBDZUx:cuqb5TrhG2ULkEa+tWb6XSZevdUx
  • TLSH
    T17B231B003BE8C12BF2BE4F789CF26145467AF6636603D5891CC451DB5723BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2