Extracted

• • Target
    ed9b3fcda56d88b4cfdefd1565eb8a636609dad1b2d7ae7c38601fd5c445712d
  • Size 45KB
  • SHA256 ed9b3fcda56d88b4cfdefd1565eb8a636609dad1b2d7ae7c38601fd5c445712d
  • MD5 4aae6166668dcfc6bb4443712756364c
  • SHA1 4349f9bea5b047bb5ccb1c5a162e8e928829525a
  • SHA512 02cab128e147fac737277bf3758a578baa771fb3846b9d358dd83bc11901fa1cf21169b8afcaab6389064bab51627de2e7464642d40666ae049c4c8071c0884d
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9AoOMwK4PIUzjb2gX3i28dlr7O2BDZ8x:0u1YJTHcw2QttU3bpXSVX/d8x
  • TLSH
    T168232B003BE8812BF2BE5F78A8F25145867AF5673603D58E1CC451DB4623FC6CA52AF9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2