Extracted

• • Target
    a8d7345e69818b883421703f506a659f4d9fe6a92bf07bbb60d0e8f337682e25
  • Size 45KB
  • SHA256 a8d7345e69818b883421703f506a659f4d9fe6a92bf07bbb60d0e8f337682e25
  • MD5 d39d2b4731ba4775758891e3c76b904b
  • SHA1 81490fd8cd75a09d060e25bf23b59bc0eae42854
  • SHA512 818f3c981c00355bf8281d77e918d19777dbacae086065e20ce195ee34c73cbfa05ed39daeb657746c38008ef84437dd96f965d87bb2cf45456624a3d5994b9d
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAmfPLziOKvtLjZPISzjb1gXGi5vmUx/tmGe1osnHjpE:kuSOpTPOP2WfHiDVjWS3bSXv5R6RdMx
  • TLSH
    T1E3232B003BE9C12BF2BE4F7868F26245867AF6632603D54A1CC441DB5623FC6DA529FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2