Extracted

• • Target
    9e9bf2ae584958d3f138969e205602887c4593a1a1a9d200f0b7e96755f70293
  • Size 45KB
  • SHA256 9e9bf2ae584958d3f138969e205602887c4593a1a1a9d200f0b7e96755f70293
  • MD5 4a93867c3632ab2ffd3070e48bda963a
  • SHA1 259ef672eee82ea8c49dac0214bd73c6afb50b4f
  • SHA512 0a815cc11a130899a96d5585c60c9e2380122909cab898b85e5e0b5daeb7efddce6d55ab64a8cbb8b46ad8ff75e47e911b1309d4a678173bcc1d73f96ed95038
  • SSDEEP 768:cuqb5TrIGuCWUoKXMmo2qQcSAFcKoabbb4ZhM/RPIAEzjbRgX3iNTsDq5+iSyBDg:cuqb5TrhG2gSAvQZh6OAE3beXSNj5+q0
  • TLSH
    T13D233B003BE8C12BF2BF4FB89DF26145867AF6632603E54A1CC4519B4613BC5DA526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2