Extracted

• • Target
    8c028460516347e74646d192a98705ab45805bd0decdd40c079e15b3d50d6de8
  • Size 45KB
  • SHA256 8c028460516347e74646d192a98705ab45805bd0decdd40c079e15b3d50d6de8
  • MD5 0d02494c9f83290bf86f3b810134484f
  • SHA1 a313fbbd3a00ce2b35066fdee0b05d799053970b
  • SHA512 84b0256b8060b1c6552ea1e9097fbe2f031294e0c82f175c66b1b78af89efec46daa09cb8c5c8860b69a599a733fe97052ed683975865de9f9ecb27e14545f5c
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwP3FoDEaOPI9zjb/gX3iq0qMqrhpOBDZMx:ku40ZTXEb25KEa393bIXSq0o/AdMx
  • TLSH
    T1A1232B003BE8C22BF2BE4F789DF26145857AF5632603D5492CC442DB5B13BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2