Extracted

• • Target
    9aadea850b463c2890d329a146dda689a32c637639cff17557e4ee5b7a5eb49d
  • Size 45KB
  • SHA256 9aadea850b463c2890d329a146dda689a32c637639cff17557e4ee5b7a5eb49d
  • MD5 0e4660e5bad39f068fdfa5ea8a904428
  • SHA1 af3ba258bdeeb5e42f1fa33d690050559d464812
  • SHA512 11e9c4492f72a41af94114a4cf5284af5a8f843012c0f0b4cd6cd573bcd7446e4b79e542dfe7081899285f5d5adf9ba0e43bd1391c3feaa3773263b9750f2cb4
  • SSDEEP 768:wuSOpTPTCFcWUeXa6mo2qAUsD/pneqPIkzjbUgX3iW9m5bWRa0DqZBDZAx:wuSOpTPOP2ksjJeTk3b7XSCmVW4pdAx
  • TLSH
    T169231A003BE8812BF2BE4F789CF26145467AF6672603D58E1CC451DB5623FC69A826FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2