Extracted

• • Target
    8324aab28863eb90d7f96777302790e725050628eeb9edb615329f8f2bd66217
  • Size 45KB
  • SHA256 8324aab28863eb90d7f96777302790e725050628eeb9edb615329f8f2bd66217
  • MD5 b506f25110d6d0e74e3421919553bc6c
  • SHA1 6d1720960dc1aa5b207e2ba9aab3ef33677fc44f
  • SHA512 9fe7fbf99bfc092293d61e51c4efba94f9e7b91d99b35177f1867ee845cad93911a8a3ffd013caebd61b325bb53b52071b2acef2e72f092cac43b00c61cefa2a
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1IBzwQ/x7PIPrjbGgX3i8j+okQRuU72eOUBDZUx:cu6YepTPso2NaFP/bZXSGjkQRKgdUx
  • TLSH
    T1E2231A003BE9C23BF2BE4FB858F26145867AF6632603D9492CC451DB5623FC696426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2