Extracted

• • Target
    9e7e7064bc7ebd8cf70afb064a509bdc985d066385678815926494a2e9b636a6
  • Size 45KB
  • SHA256 9e7e7064bc7ebd8cf70afb064a509bdc985d066385678815926494a2e9b636a6
  • MD5 055219417d5c83238a1b75e7e4d55a83
  • SHA1 7f197811df476b5688c45d317ec699f100873031
  • SHA512 31b79c8f762e2e7fe625e1ca4b6581e427ca9e8fe08c2ebb157c787ea015bf8ec38bebc7e75a04523d06dc9147a7157b6443cf70904fe383188095b602a8603e
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVOT9Qpm9PIIzjbqgX3izgvgyBEG6BDZkx:suJdpTPdI2ZQI3b9XSzglKdkx
  • TLSH
    T12D231A003BE8823BF2BE4F785DF26145857AF6637603DA496CC411DB5623BC5CA426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2