Extracted

• • Target
    9ae2ba53d44b11ed74bfbe05a638cdb671c6d09a600d6060589cbf0b7ef4f870
  • Size 45KB
  • SHA256 9ae2ba53d44b11ed74bfbe05a638cdb671c6d09a600d6060589cbf0b7ef4f870
  • MD5 19d54dd29f300a6b657a912aa5d22234
  • SHA1 00d97dea9a8437d8d5d0d8b633a542b494dc8eae
  • SHA512 9934f7a68956e9316893fa51dd34435d018ee704f4376b916a4099aee544d4af3305442b9fa4498bb1583db8a91e50b5d3159093aaabf11896b2417c0a4ceb62
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qF8mH/GmBOPIVzjb0gX3iNcAg/HZECFBDZUx:cu7e5TH2A2nmf73V3bbXSqAg/HNdUx
  • TLSH
    T1D1232B003BE8822BF2BE4F789CF26145467AF5633603D54A1CC452DB5713BC69A52AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2