Extracted

• • Target
    9a270313d6bba80634815d1f22cac9459d36b1b432324a40fa2358e47edf23fb
  • Size 45KB
  • SHA256 9a270313d6bba80634815d1f22cac9459d36b1b432324a40fa2358e47edf23fb
  • MD5 a957fb78d6e0647ddb677d1c3325491c
  • SHA1 6638d0807df6c88cf1780c4353deee9296ee1719
  • SHA512 e1d56f9e9d6fc121bf467c9f6ae4f6266eca6d2a773368e6880c925648c66255a838bacd4cc558904251d895b9961506688426203ca3b2b71e6337e9f12bc96e
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1nLiE0yFjrdjYkk8PIu6jbFgX3iImOjMDZsoTGZ1rS:wuZ8pT1tc2KLBXQBuWbCXSIjMDLGZV18
  • TLSH
    T13B232B0037E9822BF6BE4F7498F26245467AF6732A03D54E1CC441DB5723BC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2