Extracted

• • Target
    9a7114c538ff4dcb9d1365a2a2f8d61828a1ac16137c5de9f750466be3610b1e
  • Size 45KB
  • SHA256 9a7114c538ff4dcb9d1365a2a2f8d61828a1ac16137c5de9f750466be3610b1e
  • MD5 dfc511de5bc4a9b275b7d2190cc286b3
  • SHA1 f33e8d93373a93ed09a4a14d1c44e5d9f0416687
  • SHA512 1b66bc46e1fc74a4573be7cb735638973a236ae30d38945050f7835af0c92295cd5faafe9d0c91ed7895a4f3d1301498a590cc2d97267d0228ce183f38e53c98
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1JGju8eQlZwZPI5zjbIgX/ivOhFLkQoPbhrBDZUx:cuR0JTPjY2sGjuVGwW53bfX6vODgQOn0
  • TLSH
    T18B233B0037E8C12BF2BE4F78A9F26245867AE6737603D54A1CC451CB5B13BC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2