Extracted

• • Target
    9bf0d701498dd6abf5e1062e569e10fa5c45d30cba457c852443ba2f8fc446dd
  • Size 45KB
  • SHA256 9bf0d701498dd6abf5e1062e569e10fa5c45d30cba457c852443ba2f8fc446dd
  • MD5 da1dcdf62e9f71b5384e90f0f9bc3f00
  • SHA1 7e4a6bef09795f5a8d49d782eea4af78ecf27515
  • SHA512 9cc65add1f25cf5df954d66c2060cd1a47f983a253063770e8c559a66d3ffd0b8e3f2991387056eda48c8e7f9dc73fc03597fe9ff99ec9f4f13ed5d79715d0ac
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtjZbtDMQPI8FjbKgX3iitUSQE41e/X5aBDZ0x:5udApTNmU2sJk8NbdXSi4g/ad0x
  • TLSH
    T1A4231B0037E8812BF2BE4F78A9F25145867AF1672603D58E1CC451DB5723BC69A42BFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2