Extracted

• • Target
    8ba2f9b8870ae444e6637061f41bfe3c5f0153a1e666fa2a485a36c53b873c55
  • Size 45KB
  • SHA256 8ba2f9b8870ae444e6637061f41bfe3c5f0153a1e666fa2a485a36c53b873c55
  • MD5 59f459f7fbdc7272171ab7f5312b6353
  • SHA1 bb17899b6cf29e359c0869bc0ea6b50f616d09c6
  • SHA512 bd33654e88924c0acc95b6505d47aa365ab9cb7960019e2abe714f49a80166ad9ebbb85a6b995465c5827a145bd4ceafface976b4e1fcaba28b3b341e1c9a736
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlL+eXasof5l8NnPIU4zjbpgX3pPWcHqraZEu9BDo:wuDWZTpMZSB2veVG5l4AU43bmX5OUGk8
  • TLSH
    T1CD232A103BE8C12BF2BF4F7899F26245867AF2633603D54A1CC4519B5613FC69642AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2