Extracted

• • Target
    e9fd6629b24e0dc0a9bd5b70854882af0b75dabfb442944c8efab7e4a71a289a
  • Size 45KB
  • SHA256 e9fd6629b24e0dc0a9bd5b70854882af0b75dabfb442944c8efab7e4a71a289a
  • MD5 e56b6a06d871d5f0fa7c97b0ef03947c
  • SHA1 ccfd27fec85d8a6e31e26e59fe91443f7049818e
  • SHA512 84c8230a930b2f40c6481343d2454006f69ebea43bfb91400bc2be0d83f2eb487099317de9311d683c1cfc58867aedb754801f123e31c0b1e360a4b05940181f
  • SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qr3+GtCV+JtHuPImzjbCgX3iA590psgxZVBDZkx:vuogpT7I626+TM3m3blXSAsdkx
  • TLSH
    T1F5231B0037E8C12BF2BE5FB4A9F26145867AF6632603D68D2CC451DB5613FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2