Extracted

• • Target
    9b6fe90d0900435c55d448584a13fd67c8d93963cbee75ee86e0ce24a262a60e
  • Size 45KB
  • SHA256 9b6fe90d0900435c55d448584a13fd67c8d93963cbee75ee86e0ce24a262a60e
  • MD5 7f7af7d9b47f5cb829b83bdd653a6877
  • SHA1 7b0212de1f828cfe06475df8ca0514012b6f4d7b
  • SHA512 6e529c46558c2c6c85e823356ccf49c93c315a4238fd3c57c66738119c252d5c859f1550bfff22c895233507aacdf97539be316e233879f0fe0da8ab5168b574
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qF7fBohEa+PIv1jbigX3iBCTRJFi/IA4+E3KegBDZUx:cu7e5TH2A2q4EaHvdbFXSKfFrATE6e20
  • TLSH
    T1FF232B003BE8822BF27E4F7859F2614586BAF6632603D54E1CC452D75713BC6DA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2