Extracted

• • Target
    9882585a89fa892fe0a8908d7daf737b7264a87e96d2890cf400d76fe46d05ae
  • Size 45KB
  • SHA256 9882585a89fa892fe0a8908d7daf737b7264a87e96d2890cf400d76fe46d05ae
  • MD5 0915602d350e1a7028a3a36c55b7af96
  • SHA1 9844caced42ec5d8834246187d16771d58e18e11
  • SHA512 3a97ee65b86485b1b2408db2e002e30dacba3af67ac1afb055a600ea99d37bd5d8bb4b9938ea4f1f4fe786a00c5182f23e93af0e10301e630916ef8524787384
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1fLiE0yFjrdj3kk8PIh+jbrgX3iYu6/04l09/hBDZUx:cuR0JTPjY2SLBXDBhybUXSIu/fdUx
  • TLSH
    T1EF232A0037E9812BF6BE4F7869F26245467AF6733603D6491CC442DB5723FC68A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2