Extracted

• • Target
    c9af1f782b4faa8cb50a63f5c5e19492f9e2c2c8e69108285a74fefdbc49fd98
  • Size 45KB
  • SHA256 c9af1f782b4faa8cb50a63f5c5e19492f9e2c2c8e69108285a74fefdbc49fd98
  • MD5 4924d0d9a2af65177ad8fbff29f780f6
  • SHA1 4cc87070e17826f94b33c900adadaf7f370274cd
  • SHA512 5d270ef3b8aa88e2417aa309be6d569ad4d65ea2508f2ff7ad9b32cbdbaffc156270132026b131c61bd783f69f7a553571f69e24d801cf533765c27c4fe01e2d
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1LT2Qpm7PIKejb9gX3iojQTsTf1Yi1PxBDZUx:cu6YepTPso2JeKSbqXSojfJJPdUx
  • TLSH
    T1FF232B003BE8C23AF2BE5FB869F26145867AF6633603D54D2CC451D75623BC6C6426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2