Extracted

• • Target
    08d8e6e0e360a8cc18c3d90f1778ccaed7e52dad408b8ab3e8ca08d55e7f3ee3
  • Size 45KB
  • SHA256 08d8e6e0e360a8cc18c3d90f1778ccaed7e52dad408b8ab3e8ca08d55e7f3ee3
  • MD5 41de7a00a1103c331c45e305e2aebbbc
  • SHA1 4571f425c5ec98f9a61b15810ad9c27a4205f980
  • SHA512 d4d3b83fe8588d7bec0fb0f5b49c08ee90ed1b00585a007b11948f9cb441914fe1a1a208c1b8aa330b3c7654322502ba0582c1b8e238e525a4fea1b5e2367c01
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qF2seXusMkFX8vnPIMvzjbagX3sArBdtoCbm+Kr/7BDw:MuLAZTnbg2weB1FXiAMv3bNX8ArrtoWl
  • TLSH
    T1CC232A103BE8812BF2BF4FB8ADF26145867AF2633603D55A1CC4519B4613FC68A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2