Extracted

• • Target
    9cfe388aea98feea22e37a6fd574d369df03a0d9d0cd7a2adc52026aa6038094
  • Size 45KB
  • SHA256 9cfe388aea98feea22e37a6fd574d369df03a0d9d0cd7a2adc52026aa6038094
  • MD5 8d6ba6e61c56198b6f67d9674f46f53d
  • SHA1 e980d7453157b2c1af086c6bd871093693f4f58a
  • SHA512 acfc0ecef7beb7bd375b755aaa23a1ce800250131c75f9c30d3c86877f35abf0d180b0282a430967e433a5f4c57f2ce152499f08861f50947e09233a9d2fb768
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYZ/NYssPJZOPIczzjbugXriKc5L7ldorz9rjhpBDZ0x:8uuSpTgyf2hHIf3cz3bRXmP5PolB3d0x
  • TLSH
    T156231A003BD8812BF2BE4F789CF25145867EB6673603E54E1CC4519B5623FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2