Extracted

• • Target
    9897ff4748dab3216927b50cbf36ef1db7ced64224ef86b346ed077e49e48b05
  • Size 45KB
  • SHA256 9897ff4748dab3216927b50cbf36ef1db7ced64224ef86b346ed077e49e48b05
  • MD5 2dc5afa410f3ffbdd54f26fec440fdc4
  • SHA1 1e67c3c82bd34e52d1f1cf6b71a35cd4de8fea0e
  • SHA512 bbd712a3977c030924b68cace12c55f34ed2bcd1bed4114eb07c5715da7333e39f01ffebfca068e1c682f5d0933bf7931a0e76a23e00b7c79c1e2cc6e272144a
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlQZTohEaSPI3zjbsgX3io/5pFRU+EBDZMx:wuDWZTpMZSB2N4Ea733bjXSq3TbydMx
  • TLSH
    T1C4231B003FD9822BF2BE4F789CF26145857AF2A76603D5492CC441DB5713FC69A42AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2