Extracted

• • Target
    8f399eb7ca2cadc9eeacbffabc532f627de9e5551f5b24d96cbb8022ba10a658
  • Size 45KB
  • SHA256 8f399eb7ca2cadc9eeacbffabc532f627de9e5551f5b24d96cbb8022ba10a658
  • MD5 d35583e10603c60997504be3882ec09f
  • SHA1 7e03f90f3f4cd92a5f284e41ac7cc1140fa13c42
  • SHA512 f35e46b1e11a900ca37d2e106cfadf57522f8723fbc43630acce1b1a10d7b39775f031887e3abc00609fd8cdb264715add0f3908d6796b0b853e5ddaf9255a89
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFK+eXa8ofVl8NnPIUlzjbigX3Qaq4/5GmKLTgZWzljm:MuLAZTnbg2We1GVl4AUl3bFXgAMnmWzY
  • TLSH
    T133232A0037E8C12BF2BE4FB899F261458A7AF6732603D64A1CC4519B5613FC6CA526F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2