Extracted

• • Target
    9ef03e2e828828e41e27ef63af2c4168816a2af6298c4af68fd6fb1ce82a92a0
  • Size 45KB
  • SHA256 9ef03e2e828828e41e27ef63af2c4168816a2af6298c4af68fd6fb1ce82a92a0
  • MD5 bc28db47643405b07566a734ce988570
  • SHA1 f9b66052c8b05c3aa9b90184d65803c503d3f591
  • SHA512 7609853eba97b212588d63e2af5f3f9f953e1a82a2ca83b382487789b2e3682e0d585cf67ae8380fc771839bca71311d0980d327b1336e72db35ea001e40985b
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1nfPLziObvtkjZPInzjbigXBiwfyY/SSv+fBUUF8BDg:cuR0JTPjY2OfHiyyjWn3bFXQwf7/SkER
  • TLSH
    T1D7232B003BE9812BF2BE4F78ACF26145867AF6677603D5491CC442C75623FC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2