Extracted

• • Target
    9a7adf2d162707691c3993c2a70d26cab26826bc12b31102052e763428a9dc22
  • Size 45KB
  • SHA256 9a7adf2d162707691c3993c2a70d26cab26826bc12b31102052e763428a9dc22
  • MD5 49ca8a4fa88b000f9e9be7f5586ac54e
  • SHA1 bf95578d8f270dd2dd1052b0e409fd067e35daea
  • SHA512 0e8076a4a2ace24624742e4f970f9886f696638f135a23430851d1f1bdf8eed95d1bc0d878fd37d86e8ee1e3e01958e86ed4a79aa0f9d0bd4b2a7a2d736f601a
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVOT9Qpm9PI9zjbzgX3imUrQONBDZkx:suJdpTPdI2ZQ93bsXS1k6dkx
  • TLSH
    T132232B003BE88137F2BE4FB858F26145467AF5632603DA4D6CC452DB5723FC58A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2