Extracted

• • Target
    e9bad00e48f6d12ec5c5973124cc201417b94f67796c960146c313b396489897
  • Size 45KB
  • SHA256 e9bad00e48f6d12ec5c5973124cc201417b94f67796c960146c313b396489897
  • MD5 7bb00e6043fb56911a83ca0644cda218
  • SHA1 71f723a58e5512f72fe515b3d8fec0a5c2f58b8c
  • SHA512 1f341e02973d00b626fa1036da9047ac78a793347d4b1a455d1412e3e1298cec6ba12a03a2d6c3304a5ac9cebfa7ddfcb6b54baca2d8a10423f3afd0feaeffbc
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVEH0CnrQRPnH8PIE4jbrgX3ixY4DZhIzcBDZEx:MuBGJTPho2dfnkdBEwbUXSVIudEx
  • TLSH
    T169231A003BE9812BF2BE4B789DF26245867AF5632603D54E1CC451DB5713FC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2