Extracted

• • Target
    9b4f9ede4c08381244204fd1ea0aba39ee9887d8e2d92c5877a9e77403a94fa0
  • Size 45KB
  • SHA256 9b4f9ede4c08381244204fd1ea0aba39ee9887d8e2d92c5877a9e77403a94fa0
  • MD5 2afc6c08816fed045dd112249d77a372
  • SHA1 68164b8c899d6534f712a4f584db47d72c52c458
  • SHA512 bb44263c280c26be677af5d8a0c04d0c6f72afee9591594ff998a64346550e013b48cf82e0e0585ce3852dd521d0f58df15e44254d76cbf09209321cda5a9f44
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1QFpPklO08APIx1zjbDgX3i666fjaAA311TBFBDg:cu6YepTPso2d7kw08lH3bcXSBq1AF1R0
  • TLSH
    T1E92319003BE8813BF2BE4F78A9F26145867AF6637603D6491CC451DB4723FC69A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2