Extracted

• • Target
    c9473dd380c0e834bb8d51de6ba97b50ae304932c2436f7e44c972e33d813770
  • Size 45KB
  • SHA256 c9473dd380c0e834bb8d51de6ba97b50ae304932c2436f7e44c972e33d813770
  • MD5 dd44a2e5983d1c317aa68308c4a265f2
  • SHA1 815e47771825c9c9a43321eece8bc0487ceacf4e
  • SHA512 a809ae479af273e6c91e7fca000249291e2e1715380dd1084452037b4dfc01851911e21cda732ff527ee1e8e3181e13acdb395868ee5865279e4c9e1d70a1816
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4zSz8yfzuOPIhzjbxgXiip4bh2rfJ7UVBDZ0x:8uUIpT4vAj2nSQJ3h3b+XLabh6f67d0x
  • TLSH
    T1AD23290037E8C12BF2BE5F789CF26145867AF6637603DA491CC4129B5613FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2