Extracted

• • Target
    9aed0f33705b8cd6029632c5f9899b7ea142ec0339a1efcc29265b251954eb62
  • Size 45KB
  • SHA256 9aed0f33705b8cd6029632c5f9899b7ea142ec0339a1efcc29265b251954eb62
  • MD5 4e70e4c4f627470ac86ef7f712020ce0
  • SHA1 ccfacc92b3d945a92fac7c25056c3a69100e5cb3
  • SHA512 a74825a89edc3769bde92f9f987c71801e4689f02719ffacbb38595cf8b82f90b064ab9653418d85bcac029f9edf2a2bf6456fab44b3ee11af8d16c8db1bf7aa
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1TgzZUpx7PI8jjbYgX3i+tMy8dcgrBDZUx:cu6YepTPso2Con8HbPXS+WHdx9dUx
  • TLSH
    T1F9232A003BE9823BF2BE4FB898F26145467AF5732603D54D2CC451DB5723FC69A426EA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2