Extracted

• • Target
    8e3f5bcf063e57fb856f9a082b6490fa3b8674832ce61f1282f85d25b8780ee3
  • Size 45KB
  • SHA256 8e3f5bcf063e57fb856f9a082b6490fa3b8674832ce61f1282f85d25b8780ee3
  • MD5 ffbbafb92c8a72f50084e9c3972d4626
  • SHA1 1112f3dc2fa44536e831114252b74ea6d4e4cefb
  • SHA512 2b2e63402773e490dcc1a9c4c0abdcba0bebfd4e68815a919bd589df101124ff4cac1b521bc43659c9f6571ddca1c42f32cdb58816175c541426e98992ea8a25
  • SSDEEP 768:4uLZZTUAoOSWUYZL8mo2qF/eeXK5o5TN8/nPI6EzjbegX3iMtVi3FTBDZbx:4uLZZTUTn2LeEoTNKA6E3bhXSuVi3F1/
  • TLSH
    T180232B003BEC822BF2BE4FB859F26145867AF2737603E54A1CC451975713FC69A42AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2