Extracted

• • Target
    9a864882767c7b5665bbc9cb52048da7f47022e7c57e1e7d8912ecb48f6d5dba
  • Size 45KB
  • SHA256 9a864882767c7b5665bbc9cb52048da7f47022e7c57e1e7d8912ecb48f6d5dba
  • MD5 96580351b48f9e3ebe15691248be86ad
  • SHA1 918f758edcb6bdbea9a4d476b3c040545c4ffeff
  • SHA512 b5f8db2c3908c59a819e558cc1c9d1356979199519c6c5f41cb776a7b3acbfaffeeeefca0a58931549c8560e03da49c5cf6e210738718a1f85b5f1027ec4329e
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qY6iaLMwJAOPIcAzjb4gXjiHBBDZ0x:8uuSpTgyf2i5n23cA3bvX+H/d0x
  • TLSH
    T126233B0037E8822BF2BE5F789CF26145867AF6632603E58D1CC4519B5613FC69A43AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2