Extracted

• • Target
    8fbcf2e12acf678ab065e63f5668842ec15d85def7d4e799455f060a5d7dd32c
  • Size 45KB
  • SHA256 8fbcf2e12acf678ab065e63f5668842ec15d85def7d4e799455f060a5d7dd32c
  • MD5 56a3b092e0e6bc0ce27daa7ed2a0ec3c
  • SHA1 686e83bac7f0c590091f99eb1a74c6ba367c89d2
  • SHA512 3bf2102daaeae099978853432450337db7032add40777332dc497a4bf801729df66a3254c0a6f8dd635ba9f0020f052366d45787e08f41f49e3dbbd505a35a8f
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qADxJdxrPHuPIbzjb+gb3iPxJkARBMCOWVeH2oBDZe:UuKWgSJTwRf2TxR3b3bBbSpPXDOWO2Os
  • TLSH
    T169231A003BE8C12BF2BE4F7898F26145467AF6632603D6492CC452DB5623FC6DA526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2