Extracted

• • Target
    c9f5d8ee7487a4d3c498daccc330f685c2c286e6418b7248312f0d7482ca7e21
  • Size 45KB
  • SHA256 c9f5d8ee7487a4d3c498daccc330f685c2c286e6418b7248312f0d7482ca7e21
  • MD5 ec8b6cd0f0d2145da9e2a5336f7ac3d7
  • SHA1 10864171675eb8557bd694c21dc4768a6acccc92
  • SHA512 9252577f76f53b8b884e59cdde51586224b413120895331686c7d67a05b36b8723b150436ec8fb1671b88c5e7c8da920322f42a1a22ef0d3fdb238849a1743cd
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1BuwZQaKkPIizjbIgX3iLcglxYXOVNBDZcx:RuxkJTgip2IIi3bfXSI2xFVDdcx
  • TLSH
    T136232C003BE8823BF2BE4F789CF26145867AF2676603D94D2CC4519B5623FC6D6426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2