Extracted

• • Target
    9f213c749caad7e37e54ac985dfc57a1d2758a02ea8862c9344fca8a72d2afd9
  • Size 45KB
  • SHA256 9f213c749caad7e37e54ac985dfc57a1d2758a02ea8862c9344fca8a72d2afd9
  • MD5 d200b8a70fd1c60f4a6b1bb279efb015
  • SHA1 13032e2a80ef00c3cdb29289f5ea0e09c991d597
  • SHA512 63f7e63e9b805d664edd917bd6770776af781dc5a596ad63788b4bac694996ff914583ae4d250c0294eec77d1234e6e93f185b94d68572972f3e016a9dc6d284
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwGeeXK5oibbb6TN8/nPI6WzjbFgX3iTeqOOF05CHB8:ku40ZTXEb2TeEqTNKA6W3bCXSuOF0KdO
  • TLSH
    T19E231A003BE8812BF27E4F7899F26145867AF5632603D58E1CC451DB4B13FC69A52AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2