Extracted

• • Target
    8deb17f6bde15d2549dd21b396c7607642106562b1c3113df2d89696b6368113
  • Size 45KB
  • SHA256 8deb17f6bde15d2549dd21b396c7607642106562b1c3113df2d89696b6368113
  • MD5 567de1f14dcd8d783c2a0838ef370e59
  • SHA1 62dcf50d8dbb6db88fe46257a4ce1ee70019c5ac
  • SHA512 90fafd16ed77a40c71106c1942a94579936fabccd941cbe0923fc53a1d57ec732b0577984ed42595c8d4496b12adbd0e9944cdf5f1f325e8b217ba017788253b
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9L9YSkqXzNOPISzjb3gg3iTJLlFFWlgE/2PXx5b4oO:EufspTf2g2maVq3S3bQgSTJLlFolgPxu
  • TLSH
    T185232A0037E9C22BF2BE4FB8A9F26145467EE2633603D64A1CC451DB5713BC68A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2