Extracted

• • Target
    e9d48f45ee8c1ff22a52b5b8b2024e7f67e2d1da7f711cdbf58cf05572823c0a
  • Size 45KB
  • SHA256 e9d48f45ee8c1ff22a52b5b8b2024e7f67e2d1da7f711cdbf58cf05572823c0a
  • MD5 d8e9b801acd86fbe66e3c1c9ead486d8
  • SHA1 b9d8c593425f21d494789403e5b2f77460bfcc59
  • SHA512 13b72437d4e8e757a8a8556238b227ac8a602a6c8e1a4da8694299e66a90edb7b9f6ae50b9bec78a8cec7758a304ac68f09aa59c219276259d4cff6ac99708c2
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtSCSwTMSPI5vjbOgX3iThKck4xBDZ0x:5udApTNmU2lgG5bbxXSAcrPd0x
  • TLSH
    T1BA232B0037E8812BF2BE5F78A8F25245867AF6673603D58E1CC4419B1623BC6D6527FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2