Extracted

• • Target
    9e06e3d2198b30759d5eef85e875f9e8d848c48ff3cf942f06c72b26b73241be
  • Size 45KB
  • SHA256 9e06e3d2198b30759d5eef85e875f9e8d848c48ff3cf942f06c72b26b73241be
  • MD5 78266e0300a9dd83f99f5b7981f3202b
  • SHA1 738bc26fca11da4dc2db68d3bb3f7fab861033aa
  • SHA512 f92462f1568e7689eec1b9f1769290d18790e38ad3d40c76b89125b315e58245358802a22b993365798087fe241f615cb30bf15488c2a30db9d3d3fdd6865904
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4zS7synzuOPIzzjbYgXDifK/7+2s3k93zMBDZ0x:8uUIpT4vAj2nSYh3z3bPXefKVWd0x
  • TLSH
    T13F232B003BE8812BF2BE5F78ACF26145467EF6633603D5891CC4529B5623FC68A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2