Extracted

• • Target
    8a1375c701f9e6ba6e93d3b162f1c93ecbd58203a9d974d8f273b4d5490a072f
  • Size 45KB
  • SHA256 8a1375c701f9e6ba6e93d3b162f1c93ecbd58203a9d974d8f273b4d5490a072f
  • MD5 bfe2555562667ad7d78f247c099ca5bf
  • SHA1 a75e101e455f6ebfb4a7ea292fa5110b1fe17dea
  • SHA512 412054a385e299b63bd64f5be5fe6f15b9b6f8f91a17c28266aaec0d4ef1fed6f0ba953b373f49d82fe66165f257746f960d297b42831eb648ac0bed3c2b00af
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNvozfy3CKPI0ojbRgX3iqo9b48by6M12rBDZ0x:5uSy6pTpoo2xTR0AbeXSqqkX6f9d0x
  • TLSH
    T147231A003BE8D12BF2BE5F749DF26105867AB6632A03D68D1CC411DA5713FC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2