Extracted

• • Target
    8917ce3f5083e3ae3094a627d3ae7f031428df9c386dd5c206e61aa1373524b7
  • Size 45KB
  • SHA256 8917ce3f5083e3ae3094a627d3ae7f031428df9c386dd5c206e61aa1373524b7
  • MD5 ce91fd5d615b656895c76acfe2f1f0c2
  • SHA1 b3a18d6e46beee8b352300696d2b6e654306e51f
  • SHA512 b862f3963feeca5f3fb2f05cd8dbdb5d331d4dd036716d685e1d1523a7ec8c6eae046a290056c59ff0b092cfe782ee343e8f8bd04d89ce5427b2f91499403b2b
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1LT2Qpm7PIKqjb5gX3iGegRsqhhsaXjRUeLBDZUx:cu6YepTPso2JeKmbWXSB/qXsazRUeddW
  • TLSH
    T180231A003BE8812BF1BE4FB8A9F25145867AF5632603D64D2CC451DB5623FC6DA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2