Extracted

• • Target
    a9814ab0f8db55c985323a11e11dc41d41e0efbc718c0f6de313c507f5f99746
  • Size 45KB
  • SHA256 a9814ab0f8db55c985323a11e11dc41d41e0efbc718c0f6de313c507f5f99746
  • MD5 6cf4d7e35e1b2f3f7e369b15ef440421
  • SHA1 f030aa5b62cf36c6e001cd83a0823f8593c64eb4
  • SHA512 be6800e73351bfdd33a5229149eaac8953bd0ab3c50552bf0faf7620149eae333639208aa3152e533b2f78cb475cf59d6c8c5715dc1c75ce8d4a066a9e4c27f3
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1opt0CCMhdjCvS8PIjgjbDgX3isedeoEJpl2B3EBDo:wuZ8pT1tc2x/CChBjIbcXSXeuB3ydMx
  • TLSH
    T1B6230A003BE9812BF2BE4F7469F26245867AF5633603D64A1CC451DB5623FC68A43AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2