Extracted

• • Target
    9e239aa086dca5e3b0701a69f6cda28c07aa277a06466fb42258a402ed596b6f
  • Size 45KB
  • SHA256 9e239aa086dca5e3b0701a69f6cda28c07aa277a06466fb42258a402ed596b6f
  • MD5 b544b07a2127d2390d286442d7d3e2d1
  • SHA1 883dd988e3edc7cc032e0b05595eda701ab66d66
  • SHA512 1440f64fdcf23143e397764025905da409ff01e036b0246330d77cc10daa8e3c9d8b1dedbb18991615de598cf8b0ae4e5f0d3418e9b456d24525a00e2803945d
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwQ3HE4eVoOPIGjzjb5gQ3i6mD63S9Xa9IRBDZMx:ku40ZTXEb2sU1o3Gj3bWQS6Fi9K9IvdO
  • TLSH
    T152232A003BE8812BF2BE4F789CF26145867AF6637603D54A1CC452DB4713BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2