Extracted

• • Target
    8070823c99d80328f1dad4015ba3be071313f1085b76d361440c0873b1eacab8
  • Size 45KB
  • SHA256 8070823c99d80328f1dad4015ba3be071313f1085b76d361440c0873b1eacab8
  • MD5 efa96f18405106753829912d9e4debb5
  • SHA1 ea41a3fdbba1ab4550255ec17987c0e5016a9a13
  • SHA512 60239ff6595f1ab3c61b41f09f2fa47e3a3524a1473ca1ef9916c2195cc53d9e7dd460edbc00beee510c3df3aebc5314a949a8e243569e337710959c3729ab66
  • SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qjIOqwwiKqNjPICzjbbgX3Jw6S9HbV+gwEqGBDZ8x:0u2vpTDe+2/OqLKKC3bkX5w62+XId8x
  • TLSH
    T163232A003BE8C22BF2BE4F7869F26145867AF6633602D54D2CC452DB5613FC6D6426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2