Extracted

• • Target
    8fe8b61ca017402a884c69afc3cef154c6d9a21f4a45b65f175fae1385f1af57
  • Size 45KB
  • SHA256 8fe8b61ca017402a884c69afc3cef154c6d9a21f4a45b65f175fae1385f1af57
  • MD5 d9cc03f27a8fb7b4dae08884850d23c5
  • SHA1 d5f0343407f6de334145043fbc9bf87f5ca9ec15
  • SHA512 e3ee57a4c816d2848a8e14af11adcb0d50b12b73db90e0da31623a4b3024a14f8fa8f89f761657629436788cbe5b352e7527232df3c89a29f1c910c1985be273
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYlCSwTMSPI5rjbOgX3iDN89lSQW5UsNXBDZ0x:8uuSpTgyf2dgG5/bxXSDN8nS35UsNRd2
  • TLSH
    T1DB232B003BE8812BF2BE4F78A8F25245867AF5673603D54A2CC451DB5723FC59A427FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2