Extracted

• • Target
    9ea0bd87d8e4276168ddffe9b03abe102c04909f6a7761e1ef66d06735f4ea04
  • Size 45KB
  • SHA256 9ea0bd87d8e4276168ddffe9b03abe102c04909f6a7761e1ef66d06735f4ea04
  • MD5 4f59de226a1c96d8d6f8a36515ab5306
  • SHA1 dff217ce758d1ceaa681a047f56fc9437791df4a
  • SHA512 544d8f4513f600405686b0fa1ae4c39121290590a1b8e58d06de3e14feed20dbbbddbb01b2cff66b56f5ebef0e8825ff31e640d907499d9feeb97e35835d5951
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVe0ewtSc30oiZPI3zjbegX3iLmiyJZIwCzveBaBDZG:MuBGJTPho2tww2iW33bhXSLjyHIdWGdG
  • TLSH
    T193232A003BE8812BF2BE4F7469F25245867AF6637603D54A1CC451CB5713FC68A43AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2