Extracted

• • Target
    9d632d94f5674748532fca6bfa2856912e73d3e1b63f3e30382ee047994ae485
  • Size 45KB
  • SHA256 9d632d94f5674748532fca6bfa2856912e73d3e1b63f3e30382ee047994ae485
  • MD5 969a179bf6947924959de8d9aa2b2bd7
  • SHA1 eac85ad85ffa85374a1f7c04e9cafe0fec5a8ab4
  • SHA512 f86acaed65b2d503d1a29724f1bf51e4ab639951682adfc8f0058ec1db8ef518d49332630d0e62aff501883e9f7a7bba36b6b3d2af867d060e6d06b2fbd89af3
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1GcP0pycvHPIjzjbQgX3i2X7MKrJ1AJ/t7YuWiBDZO:wuZ8pT1tc2FccMcvgj3bXXS2LMIA6uP8
  • TLSH
    T1B2232A0037E9823BF2BE5F7898F261854A7AF2633603D9491CC451DB5723BC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2