Extracted

• • Target
    08ea05332cdf59624f27777cbe20e041e3f73d0a744b83300aaed6ef64e7746f
  • Size 45KB
  • SHA256 08ea05332cdf59624f27777cbe20e041e3f73d0a744b83300aaed6ef64e7746f
  • MD5 c8b1f4364a19ec57e312319f731b3fe0
  • SHA1 77471a91b2b3ea1669364cc5d012edd47647b231
  • SHA512 b30e86591592192687aad8688e5388b6eab3bf3ef159bae64ecf4600faf1580c38e93e19722a9c57db3ce53fe97da88fb80e798314aa977d819891270bb50152
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFdm/9GgrOPIRzjbqgX3iop8yrR3TTpKLBDZEx:MuLAZTnbg2um1b3R3b9XS08wRadEx
  • TLSH
    T132233B003BE8822BF27E5F78A8F26145467AF6732603D64E1CC451DB5613FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2