Extracted

• • Target
    8df57b0a5f57b5f2ff31ea62c4cfc596d4c33909ac3fae60ea020076c5164f1c
  • Size 45KB
  • SHA256 8df57b0a5f57b5f2ff31ea62c4cfc596d4c33909ac3fae60ea020076c5164f1c
  • MD5 ee0d3533b490ab298ee97071d84e4d90
  • SHA1 029512de15bd11349a481250e285142735b01be1
  • SHA512 12c19ecfd1dce6579cfe272fc758ee133b3cadc703d22437dd5623b245862dca6ca462458c6c45e9b0dede550beb1e15323763ef6e883d9240375d8a2b66bbbb
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVeBzCQKx7PImEjbBgX3iHx6jFzA1i9BDZkx:suJdpTPdI2/o0mEbuXS4jFzgKdkx
  • TLSH
    T1D32319003BD8822BF2BE4FB898F26145467AF6637603D94D2CC451DB5A23FC696426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2