Extracted

• • Target
    8bd1acd5343df29bb0000338c85100d752baee73eb51ecaef4abc76521e3e61f
  • Size 45KB
  • SHA256 8bd1acd5343df29bb0000338c85100d752baee73eb51ecaef4abc76521e3e61f
  • MD5 86a545d4d6715124a7bc63284ae38000
  • SHA1 1f57d768541099ca2709de48dc359dd2a7751791
  • SHA512 687e7f48ef38c73bf660c5a1c1db0665bfab0148072a85756b4339e2f401a8e7d10acc1350588c25718879c7805f9928715698a0fbd0fb5eb0ea58b0bc320037
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVe8V1RpPEcPIMzjbbgX3idG/jnf489odARBGkBDZEx:MuBGJTPho2t8VDZEhM3bkXSdGDzosNdG
  • TLSH
    T1E6232B0037E8812BF2BE4FB8ADF26145867AF6636603D6891CC441DB5713FC69642AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2