Extracted

• • Target
    9e299379f887cb2f51c448d64a64c1c4449077210750cc0d6262cd4bd5f8e6fe
  • Size 45KB
  • SHA256 9e299379f887cb2f51c448d64a64c1c4449077210750cc0d6262cd4bd5f8e6fe
  • MD5 7b99d813901c7dd44e2ec13c6be1b370
  • SHA1 1a8265b07c0a0175b0f3a1d3092aa8bb9df1af69
  • SHA512 929193f7268b4142d4924ee1f37916740c1cd7e40979f341ea3264f22516861b6ed903c22a7e9227a3fe027d10f068e6d70f2fbfb37d501d0ada99030323c630
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFg3Xo5EayPIwzjb5gX3iUOE/Fsd2zGNpBDZUx:cu7e5TH2A2LQEabw3bWXSUOaE2KddUx
  • TLSH
    T19A231A003BE8822BF2BE4B789DF26145867AF5637603D5491CC4119B5713FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2