Extracted

• • Target
    9d010c33251bc3691d0a93a07ac6044837c2570b0eb63473ae60d435962f377f
  • Size 45KB
  • SHA256 9d010c33251bc3691d0a93a07ac6044837c2570b0eb63473ae60d435962f377f
  • MD5 fd3c07d5da04fc6042ddf1ee49d9b9c7
  • SHA1 bef3cd0f0ffbbd7dc16def43128df70dacbe9767
  • SHA512 6984fba429b3f70cbd5b4bc5e5af786db550b8d21250ca6e886b4885b862898e3add3dd58184cfeb088a2148cab3457d2f811ec1c3f3f87bd82128f1e59941d7
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVJpt0CCM+d4CvS8PIMfjbkgX3iPg1zYjGd1AYBDZEx:MuBGJTPho2Q/CFWBMrbrXSuZ1rdEx
  • TLSH
    T1C3232A0037E9812BF2BE4F78A9F252458676F6633603D54A1CC451CB5A13FC69A436FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2