Extracted

• • Target
    8fed772a76012dc24d0c761ba4fc24c41cc4581a566724c5a69b6d82ef6cecef
  • Size 45KB
  • SHA256 8fed772a76012dc24d0c761ba4fc24c41cc4581a566724c5a69b6d82ef6cecef
  • MD5 ba77eb29a6511e8cf3af7f0047accc3f
  • SHA1 4e8ba128f017320214fec029fabc221253f32bc3
  • SHA512 453ff8de4ed43366ed0481e5efdc769075ce1328daba982ece75cbe80c8ef331b4cff16f2feca57f2dac2edc53448e66df280ddc3cfc055d722e3103f312d589
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1N8V1RpPEcPIMzjbqgX3iTZbc0naBPHuf4RzRWBDZUx:cuR0JTPjY2+8VDZEhM3b9XS5cvBPOkzB
  • TLSH
    T103231A003BE8812BF27E4F78ADF26145867AF6636603D64A1CC4519B5613FC68A436FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2