Extracted

• • Target
    9b0aef2718a144684b9377531e00be75c68e86873f5e283e6028ec9ee361b754
  • Size 45KB
  • SHA256 9b0aef2718a144684b9377531e00be75c68e86873f5e283e6028ec9ee361b754
  • MD5 d53f85c35bcebee5f8833a5d8928b596
  • SHA1 0eda7097817c14e1a8a6a1f33526b927af66651a
  • SHA512 db345fdec71de6872479862081b73a6b487b0d4f52f32475603e2fb1c40eefa88daada96d2f6ef7bbcc2091f529cfb47e3713576cd0eff1b0748fb3fe3333c6f
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9vZbyDMgPItLjbygX3iGB1x9iTOHJGOxBDZsx:EulCJTHl42QmEtfb1XSGfxyOHTPdsx
  • TLSH
    T1EE231B003BE8C22BF2BE4F7498F26145867AF5673603D54E2CC4519B5623FC68A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2