Extracted

• • Target
    8f1078275d3a345829952da3b7de9e2709d153110ea94635e2b95d026ea8a558
  • Size 45KB
  • SHA256 8f1078275d3a345829952da3b7de9e2709d153110ea94635e2b95d026ea8a558
  • MD5 045a1612bf3cbbc03e0ed0f6c9a618ed
  • SHA1 494618d01bc4fe73dbc598532897b4be00ace273
  • SHA512 ef806a5a9f7cb83d83383f85f2a53ab0d60c31b626d3380d4a3336e3928bd93797e36e10833a792a209fc580eb418f72c29894c0674746b1705c457d41462c2e
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9aCSwTMSPI50jbBgX3iichc+MMNYBDZ8x:0u1YJTHcw2NgG5UbuXSizAed8x
  • TLSH
    T1E0231A0037E8822BF2BE5F789DF26145867AF6673603D54E1CC441DB5623BC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2