Extracted

• • Target
    be8040605bd2858cbeff2a5b783acdc4b8f8b7e4a864262f2cd7210fcacd8b81
  • Size 45KB
  • SHA256 be8040605bd2858cbeff2a5b783acdc4b8f8b7e4a864262f2cd7210fcacd8b81
  • MD5 4e599f17df7ddac5b4ab628e40054b4a
  • SHA1 35f9e40b9dcffd55e28bd9d28e458b8ccdeaff38
  • SHA512 8b2477af4d473d3b490b512e1fdc70669f477efbea184285df82ce4c3bf57ecb06bb6ce5671f7a3907f8cd3e395fab3b60ade7976d96e2b5e3f4f9c5138e396e
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAI0e3+Kv18iZPIezjbSgF3i8qA7O6VDQBDZMx:kuSOpTPOP263T6iWe3bVFS8HsdMx
  • TLSH
    T122232B003BE9812BF1BE4F7868F26145867AF6736603D5891CC441DB5A23FC69A436FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2