Extracted

• • Target
    8f62c30b0e0cdbfa10515c9046d9d14770bc87bf32e4503f7ebba5cd97296aeb
  • Size 45KB
  • SHA256 8f62c30b0e0cdbfa10515c9046d9d14770bc87bf32e4503f7ebba5cd97296aeb
  • MD5 72fec0562ce7c94a69f203bdb29c0ea7
  • SHA1 14eeb5d4a3c7a801a1ea636f774bf887012004d1
  • SHA512 37b794f3a136249d12ccc5c641268ebbd17ae5ae71681e89de7b6932460bf252cc888a57bc00fdb999f228d20a1f9ebf457d459a3c7e3f2c4a9197a9540bd8d3
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAaLiE02FjMdjYkkmPI9zjbXgX3i9a0oiZv4dYcH4eB8:kuSOpTPOP2KL9wQP93bwXSM0f4dYvwdO
  • TLSH
    T125231A003BE9812BF6BE4F74A9F26145867AF6732603D58E1C8441DB5723FC58A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2