Extracted

• • Target
    9e7e85711ac3bf3873fcb25da6f8073b1f043586be06cf6ff20b49aa936006a8
  • Size 45KB
  • SHA256 9e7e85711ac3bf3873fcb25da6f8073b1f043586be06cf6ff20b49aa936006a8
  • MD5 eda6d4bfd3fe11132d2a5d28615ffe77
  • SHA1 bded868fc986461a9c1101acbaec3a5c72e81739
  • SHA512 ae3ca34880b02b74138ab2c9060adf0dc8bef1ab3d6f3ab042f9f6734e165d498303532fabd0a248ca6a084a43f5eebcf6db9fc0dfd9f5ac8465bb90f1d8555c
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1zGsGx8OHuPI2zjb9g43iCsIUJ63GZBdqALRQDSBDY:RuxkJTgip2+ez323bq4SCshk3ArqAaos
  • TLSH
    T153233B0037E9822BF2BE4B7898F26145467AF2637603D58D2CC452DB5723FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2