Extracted

• • Target
    9987a5f4e125995f7c6e11a9ffdae80d25b12774eee4be9b2396554ffcb430aa
  • Size 45KB
  • SHA256 9987a5f4e125995f7c6e11a9ffdae80d25b12774eee4be9b2396554ffcb430aa
  • MD5 76dcc2d2dfe9c59b59b032486d95aa90
  • SHA1 0e71e26ee2e0f70e75055cd44c46a4151edefb90
  • SHA512 bc256d630e8533d2f4c29b458e1113c92f5ee76ee41b8dbcc343cae7e767f5123ae83583719f72ffa7fd75c5e8980f9bfcd8649c018a202da5209521406f0e80
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1mb30GYjHuPI8zjbXgXmiWOBl78HLig59mMBDZUx:cu6YepTPso2jw/383bwXP1l7cv59mKdW
  • TLSH
    T107232B003BE9812BF2BE4FB898F26145467AF6636603D68D1CC451DB5623FC6CA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2