Extracted

• • Target
    8f5bee696b97f57cfaa717ec37a1954657fd13975662a3c4a212a3dff0ec2e2b
  • Size 45KB
  • SHA256 8f5bee696b97f57cfaa717ec37a1954657fd13975662a3c4a212a3dff0ec2e2b
  • MD5 9e60dd59f4690dec095ed5c7ddf18498
  • SHA1 6c7f6b797af5706d94c0ed5c0a9f56673a78e5fb
  • SHA512 a5c89c68abb3d50288d33499f2464520c593e3922da9fdbfdcc32bba2a8dc1ce4f7526e976dadde50700f1850ab7bde313666bc4484bd7ba1d10ac3127ae1a6c
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1HmaPylF3APIFzjbMgX3it14xKYg4Sg94RINhpMG:cu6YepTPso2Wfyv3lF3bDXSAxIo9DNhz
  • TLSH
    T1B72309003BE8813BF2BE4F78A9F26145467AF6637603D64A1CC451DB4623FC6DA426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2