Extracted

• • Target
    9b5e9a5c5f459aca8ceb794156931f0658cc3c934de969918edd6f58e4852f9c
  • Size 45KB
  • SHA256 9b5e9a5c5f459aca8ceb794156931f0658cc3c934de969918edd6f58e4852f9c
  • MD5 7e66a3e326cf725c4c4b4f13c9297544
  • SHA1 6fb3f2a228798293597605892fc29e410728a923
  • SHA512 1c46410d3d1bf22f020c89f55172bce213b386014c048ca389777df3545c7fbcbf7ff67097017e1aaa7ecb5d67fc133bf1c16c0a068b8d40a8d961ff1f299007
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q95dR3aI6OPIuzjbGgp3ip+vI8nwBDZsx:EulCJTHl42mjqb3u3bZpSYIWmdsx
  • TLSH
    T14B233C0037E8C12BF2BE4F789CF26145867AF6677A02D58E1CC4419B5613FC6DA426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2