Extracted

• • Target
    8eb8e1a5a9f342d518a0ee9753e721cc76c14fd87402cc54d7ba5891a0ad88c7
  • Size 45KB
  • SHA256 8eb8e1a5a9f342d518a0ee9753e721cc76c14fd87402cc54d7ba5891a0ad88c7
  • MD5 74f8426f0f95b3dc0dc56c6f2ba78fb6
  • SHA1 d67a648a358eda31555441dd3e672e81c1a8092c
  • SHA512 74bf069775fa02c3728fe28c579a53dac62a442e1ec451d6161128722da6b211d2e157d09774f03dbbbeb43c4dcfe9872a812206079a79269d51548ba93fc784
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9TZo3TMtPImzjbqgX3iM8S+a8xnD57BDZsx:EulCJTHl42sU3m3b9XSK+Rdsx
  • TLSH
    T111233B0037E8812BF2BE4B78A9F25145867AF6673603D54E2CC451DB5613FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2