Extracted

• • Target
    9450fd3762eec351fefb732f4a8cefb822cb33d37b115bdcb410a40db6f9517b
  • Size 45KB
  • SHA256 9450fd3762eec351fefb732f4a8cefb822cb33d37b115bdcb410a40db6f9517b
  • MD5 aa4ba1e9e98eec97dbd1f2acbdcaa7e7
  • SHA1 c9309320b9a3a0393dbb07ce6ffd05fb354a3245
  • SHA512 dd6951fbbe02c0d415bc0d47b93e252d7d16650b75120817aef7f81cc021806a24435e54e091f60a3c521fed4cab94495d93691c72334192dfa8ab661b7c953e
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1QFaPklZL3API+zjbEgX3iWpNaEqpFk/QymzLzB0:cu6YepTPso2dEkfL3l+3bLXScNQyiLV0
  • TLSH
    T118231A003BE8812BF2BE4F7898F26145867AF6677603D64E1CC441DB5623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2