Extracted

• • Target
    9f4557a419b02da9b28a779f54b8a02df338fee099c754d9eea63c19df24bbc9
  • Size 45KB
  • SHA256 9f4557a419b02da9b28a779f54b8a02df338fee099c754d9eea63c19df24bbc9
  • MD5 c37cd1f50f9edfdd3c8395891c43e881
  • SHA1 e1c9d4ba9959a21b26027c2fa9cf333f35662236
  • SHA512 efaf14b6cc6977b41a48278bd9f4c979285e8863a62268cfc168317792c46ea92cb014d625ccd5eddf3a7521c3cf3187ce310d2988b9b7a3f01eda86df427275
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qF+UJ+XOoJ9hU/NPIEfzjbygX3i+v5YLrKTw1ToiwoW:cu7e5TH2A2DU0eI9hyqEf3b1XSoarNX2
  • TLSH
    T1FD233B003BE9812BF2BE4F786DF261458A7AF2633603D54A1CC4519B5613FC1DA42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2