Extracted

• • Target
    9546d1d3a111de241dedee685f797a5434fae4c99fcebfa3b8622ae1d74cb258
  • Size 45KB
  • SHA256 9546d1d3a111de241dedee685f797a5434fae4c99fcebfa3b8622ae1d74cb258
  • MD5 d669d6ca886f4f7df2c97c18264fcb34
  • SHA1 78322b6992a60e27e0c94e195154a9c41ac45732
  • SHA512 360dd5973cb9aefeefa9e6faefa8c3cc31268ff5909fb88c8d099a254a1a1b8abffc9fe4a4ad37ca688e47e0fdc428f875837882b8ae945670d9b950357a16ab
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4D9wScq/z1OPIszjb9gU3iytTYOGpBDZ0x:8uUIpT4vAj2Hi9K3s3bqUSytTYOwd0x
  • TLSH
    T19A232A003BE8C12BF2BE5F78ADF26105867AF6632603D54A1CC451975723FC29A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2