Extracted

• • Target
    9ea07df9311f88c6b8ee06ad9096d58e0dd1d2f267b1fcaf4aebdfe6741e3cf4
  • Size 45KB
  • SHA256 9ea07df9311f88c6b8ee06ad9096d58e0dd1d2f267b1fcaf4aebdfe6741e3cf4
  • MD5 b399f396e700d0f1e76bc66a4f4ebe2b
  • SHA1 efcf64441f844d0e5bdcbbb551fe26e0b0c05427
  • SHA512 826154f32fbde0a6d84b9daf8580c97a99bdfdbdee2bf81ba2067a78676f4c8d804f576581c9268a531908bbb4ef008d8b78610f51c72e33d27f61becf7b4988
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4UwD/y/aqPIOzjblgX3i+3l0GOLlfBDZ0x:8uUIpT4vAj2wkhO3biXS+w/d0x
  • TLSH
    T15E232B003BE9C12BF2BE4F789DF26145867AF6632A03D6491CC451DB1713BC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2