Extracted

• • Target
    8e32ac83e3dfe56a6008cc4e2e7c2d2b667e9606ed7541ea6370d4482c24ddac
  • Size 45KB
  • SHA256 8e32ac83e3dfe56a6008cc4e2e7c2d2b667e9606ed7541ea6370d4482c24ddac
  • MD5 096e09ffc61ed7b1bb782e2ba82b651b
  • SHA1 720c8a5fd0a7e47e332fa28e935a42fc5de16aa8
  • SHA512 569ac84ef13ed01d42d064b7b56b282c5d3023661790f5313ae9a6042b10a2bba312f03a58a2d4502e4a3944509c2dc32e4a25f6c2e7b7df397234a9edf24bf8
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFyls5ohEaMPISmjbjgX3iLUnFC69wLXYZ2BDZEx:MuLAZTnbg2X44EaxSKb8XSLkLeXcYdEx
  • TLSH
    T19E231A003BE8822BF2BE4FB8ACF26145467AF6737603D54E1CC451975613BC696426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2