Extracted

• • Target
    8e17c7d9c30983402364b2c660c47e6d4841c1a42345cb405140b14647fff17c
  • Size 45KB
  • SHA256 8e17c7d9c30983402364b2c660c47e6d4841c1a42345cb405140b14647fff17c
  • MD5 9f0962adc462354b8e29a74c8e4add67
  • SHA1 e4c67af48ad1181ea5a322a983a9ef3c50b47d9e
  • SHA512 d2bf272d97efafb2236aff8a21b3d60890bfffc6dca109814d663737a154e6fce1d1b45c2f1d2b9ed014d9c1336cae0c55bb4cd912c06b4e73fcfcd4fbdcb690
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYZ/cYssPJZOPIcvzjbZgXCi5J8IBVMmyTlBDZ0x:8uuSpTgyf2hMIf3cv3b2Xr5zTMmyTrd2
  • TLSH
    T130232B0037E8822BF2BE4F78A8F26145467EF6633603D54E1CC4519B5613FC69A52AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2