Extracted

• • Target
    9fd962eb66100fee401af7dea83b07ed739d9d24d6dd022d683acfb62a7030b9
  • Size 45KB
  • SHA256 9fd962eb66100fee401af7dea83b07ed739d9d24d6dd022d683acfb62a7030b9
  • MD5 20f0c760ea8d5a681f77cd87053efd81
  • SHA1 099ee67a333e87f860d58de3055e2bacb6804984
  • SHA512 bb138ab86ca8e1a341f5b9acf4bd74a4eccc6d0a01b6e5c8be5f2212fe1fa0cd4764ae937be38cd7cb7a8f343e988a491821bc1a282142a1c4982edd1657f64a
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1LT2Qpm7PIKdjbUgX3iZctjf7ARVhYyYuDM0O5ux:cu6YepTPso2JeK1b7XSydfgVuADtO5ux
  • TLSH
    T1A0231A003BE88227F1BE4FB898F26145857AF6633603D54E6CC451DB5623BC6DA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2