Extracted

• • Target
    8b589e7bf99d8324c1ff8925a37e5cb186373f006fa53a437572ab77804b9ad7
  • Size 45KB
  • SHA256 8b589e7bf99d8324c1ff8925a37e5cb186373f006fa53a437572ab77804b9ad7
  • MD5 995d19bcfbb24dd3788758fa7bbb4c41
  • SHA1 f30cffcdc66e1f01ff55a4b9ec0a1d54ae46df32
  • SHA512 ecf4f51efe0f783b8858082877ea6a656cb7b1a033309588ea944d886f759aa19ab2cbae5f81fcbc8a132a2e4509365cb2541ceb9a86f368827eaa4baa891489
  • SSDEEP 768:4uLZZTUAoOSWUYZL8mo2qFrfBohEaEPIQKjbxgX3iVFnzeJ6CBDZbx:4uLZZTUTn2a4EapQGb+XSVFnudbx
  • TLSH
    T1CA233C103BE8812BF2BE4F789DF26145467EE2B72603D54A1CC412D75713BC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2