Extracted

• • Target
    a9f321c46917bbed51b15c8cf9310dcf2ef6f350ceb8d574193c8db05ba5e176
  • Size 45KB
  • SHA256 a9f321c46917bbed51b15c8cf9310dcf2ef6f350ceb8d574193c8db05ba5e176
  • MD5 196d3882f6d1c77adc78e1165328228a
  • SHA1 dc76785d71b1f45e5028853c5beae70a0c7bb2a3
  • SHA512 ed54c67e771f1ac5c808dcbdce0b612ca25a7e923daf999b064a2dd88109a1c76f0e6e410299473a79c08579ff4053755f0aabf33350cb1dd214915c93ca3766
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlyBlte40WMOPI0Izjb+gXxiOlQRCQav7xDtPfjKn:wuDWZTpMZSB212UM30I3bBXgOl9DxDV4
  • TLSH
    T1DD232A0037E8C12BF2BE8B78ADF26205467AF5732603D54E1CC4529B5713BC696526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2