Extracted

• • Target
    9356af694b8be8a80bd47b2f6ace91e5c54a4a97cdb80304261dc6e81f8e8de1
  • Size 45KB
  • SHA256 9356af694b8be8a80bd47b2f6ace91e5c54a4a97cdb80304261dc6e81f8e8de1
  • MD5 ca3ca4c39642d64c4b0c1ddeb77588ec
  • SHA1 2121537dc1110da249b18c25f48230f2fde48ce6
  • SHA512 cf695780657f58e3f2b4ece1f1c9186c765c29ba1e0e47876037b40ab2c41a5cc3b8b2becb59b50b20fd6f7b14ec2de06763375ecc4a5f91879899a5e40409f8
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1opt0CCMhdjCvS8PIjqjbBgX3iUvqjYr0EnBMdYSB8:wuZ8pT1tc2x/CChBjmbuXSUpr0xdYsdO
  • TLSH
    T169232C003BED812BF2BE5F7869F26145867AF2732603D5491CC451DB1723FC69A43AEA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2