Extracted

• • Target
    9ad1a8e2cbd282ec8ba50249390432f641580fe53845ca32adc48e06f4bb3b3f
  • Size 45KB
  • SHA256 9ad1a8e2cbd282ec8ba50249390432f641580fe53845ca32adc48e06f4bb3b3f
  • MD5 6ee3188627185147a7e336c0bcf659c2
  • SHA1 66ffdff739d39a66da14a819aa8b946064cb12f4
  • SHA512 b66a6ea0adf9677e16cc5ac3deb31cf3aa26ed28d6805b4335c73d27f37e5fcd80897ba885fccaec3a311dca80778b7be526f48cd0a3da23c13fe3434f0ad5ff
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9x/rLzlJAOPIc6zjb3gX0i4WJbRbcarm9s0DKBDZsx:EulCJTHl42ePp23c63bQXR4GbRbcai+w
  • TLSH
    T1F3231A003BE9822BF2BE4BB89DF25145867AF6732603D54E1CC441DB5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2