Extracted

• • Target
    8884eff2267ed9e733af78b84f830a303601f375cb839192a88091ce6cf363d8
  • Size 45KB
  • SHA256 8884eff2267ed9e733af78b84f830a303601f375cb839192a88091ce6cf363d8
  • MD5 f84c010297e917451ee490e073afe45e
  • SHA1 f81361df76f040f4d96cafbab0d9e79999a7514c
  • SHA512 c625a997ef3131936f505b414b2d1da1f6a6ce6b6b7bac36f5c8129fa07bc60d4c1d0efa2f8f947fba1bbfd02a4b1a1dbdd6e102ae0a40f57051abb6dfcd8da3
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qV2maPylF3APIFzjbjgX3isjOxA6XQNSXR9r6BDZkx:suJdpTPdI2Hfyv3lF3b8XSsjOxA2NLrP
  • TLSH
    T14A232A003BE8812BF2BE4F78A9F26145467AF6637603D64D1CC451DB4A23FC28A426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2