Extracted

• • Target
    f8db8badd0caaec4feac1a6d5db006e99a2f9a4a5cba93476a11a5f72bb08d15
  • Size 45KB
  • SHA256 f8db8badd0caaec4feac1a6d5db006e99a2f9a4a5cba93476a11a5f72bb08d15
  • MD5 e89934ee0fb662a1d1b3c5863126b22a
  • SHA1 2ddcfdfa452b0ff2bb0a7cd7fbe9195e68e8db54
  • SHA512 9f58b665e179d74f1c7feb3375189096890a761c7cf2d4de0de4ab0296e46fa3e63aa0f1e03cb3d517dfb3b410005c5aaae964d665460ce2621ca01cf460e5bc
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q16T2Qpm7PIKmjbdgX3iQ5bK357GiR4BDZcx:RuxkJTgip2meKKbKXSf5edcx
  • TLSH
    T1F9232C003BE88137F2BE4FB8ACF26145857AF5737603D54A2CC452DB5623BC68A526F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2