Extracted

• • Target
    86cf8ba53fbc30c7f694b8017070318fbaff9a6bc77289877acdb5bb5832065c
  • Size 45KB
  • SHA256 86cf8ba53fbc30c7f694b8017070318fbaff9a6bc77289877acdb5bb5832065c
  • MD5 b2ccfb9cf41987e5146b4e40fa3cf6ec
  • SHA1 8cc1506b146f92dccdb18498f69d322e75a1597e
  • SHA512 5b8b1e2a86b8c2cc8b1fe77c2942e2a4f8c34325b0677c034e18920bb6fb9487473c93be4e335c6622356b4e764fadda8e3a34c7a5f9c2e4ba299fbe5646a87c
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4UzjHy/aKPIbNjbSgX3iVFbybyY9BDZ0x:8uUIpT4vAj2wnhbFbVXSmGYTd0x
  • TLSH
    T1F8233A003BE8C12BF2BE5F789DF26145867AF5633A03D5891CC4129B5613FC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2