Extracted

• • Target
    d8983cd42333f530ff62b361acf65d2f66808781b0018c87020545330b7c71af
  • Size 45KB
  • SHA256 d8983cd42333f530ff62b361acf65d2f66808781b0018c87020545330b7c71af
  • MD5 085989f4004d2ed58658beab5dd2f8bd
  • SHA1 fd06c0df7c7269b5658452e4ff9e05c80ad6f2ac
  • SHA512 930cf2a7b47110d45542a4cf55dd6adafaf80c874bb9a8cb3dd14e761f820f46484b2028df9cb9c3272009b41aa7d168d46d13aebfc5ae1dba52402e92a3a385
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1UQ0D3+/vPPjZPI7zjbsgD3iyui4rRfPD/v8BDZMx:wuZ8pT1tc2rP32/jW73bjDS+IPbadMx
  • TLSH
    T1D4232A003BE8812BF2BE8F78A8F26145867EF5672603D5491CC451DB5723FC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2