Extracted

• • Target
    9bd7a2b875bd36589760699b2ce0a9413e9d9f59aaedb9547f6667fd213d090f
  • Size 45KB
  • SHA256 9bd7a2b875bd36589760699b2ce0a9413e9d9f59aaedb9547f6667fd213d090f
  • MD5 d33ac573b9b9b8efe44257c5bdde4ab8
  • SHA1 4c5eea3fccce84bda45bdeae5ae06e6878b6bbf7
  • SHA512 1effe8226d1450281421dd42b229a5819f522bff4e36a8d5f897c3f2218595abbe24f9de1402a7bdbe99a50a64986a23206c7275d1974b3a44fd0fb04061eee1
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1IBz3QKx7PIQtjb+gX3iNmTNZVQkd76BDZUx:cu6YepTPso2NV0QlbBXSQZZVphkdUx
  • TLSH
    T15E231B003BD8823BF2BE4FB898F26145867AF5736603D5492CC451DB5623FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2