Extracted

• • Target
    8112b9525f854861990ff41a73ba404565dc3af8340b9646c896ce86435928f2
  • Size 45KB
  • SHA256 8112b9525f854861990ff41a73ba404565dc3af8340b9646c896ce86435928f2
  • MD5 a7a0be38c3865473c4903f15ee230371
  • SHA1 2b3dd4daa42ccd2f409535cc968c4d8dc93658e2
  • SHA512 c84cd1644ab336ea2d5b38838bb4152a49cf70f671d184270efcf34e2f4d54fa611971704cb3f30c80862cef1b4303a6a8d1e3f03c77ac4854069515b8e0f398
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFuSKFWKoobbb4vhy/nPIALzjbagX3ihhaXfU7pg/5KI:MuLAZTnbg29SKdivh4AAL3bNXShhh7u7
  • TLSH
    T153231B003BE8812BF2BF4F7899F26145867AF2632603D59E1CC4519B5723FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2