Extracted

• • Target
    8396792b9dfeeecfa2ea6c87dc43383dbcc22d8e19ae0424d73eadd9571faa6d
  • Size 45KB
  • SHA256 8396792b9dfeeecfa2ea6c87dc43383dbcc22d8e19ae0424d73eadd9571faa6d
  • MD5 c28c95bbf6947bc317e67bb674f4f571
  • SHA1 2830165c0eb16594e5dd692c6d669e753ad96813
  • SHA512 522877dadcd2bf7fa967fcb1f6663496b4fd5f196b5045bed3beb0f0065a892193bd358a58a53bcdc36df1d82fb7ee371ef60efdb5a3731a71f0366ecc1ec85c
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFYl9fcBEahPItqYjbigX3iHBChDxb6t0Kn15ud+BDZG:MuLAZTnbg25LkEa+tqQbFXSh4Vut0mT8
  • TLSH
    T113232B003BE8812BF2BE4F789CF26245467AF5736603D6491CC451DB5723BC69A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2