Extracted

• • Target
    9d676d19b831dff86ae73386a81dfb944da00d57b05c97e28ff74322cc2e01b2
  • Size 45KB
  • SHA256 9d676d19b831dff86ae73386a81dfb944da00d57b05c97e28ff74322cc2e01b2
  • MD5 868ac297b866d30bac03dc183eba7369
  • SHA1 ea967676b889abb263a32cd887e33042c6d280b7
  • SHA512 f4b430680a2724d567f73eb52832df35d87956de0a6efcf29c00934771d22a1b23b9ec34fd9052a4df98bf90efc0f33ca742a2bf587d1aec2ace751c4a722d71
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qA1cP0pycvHPIjzjbmgX3iYihHDc+rQVxABDZMx:kuSOpTPOP2FccMcvgj3b5XSphjc+rQVL
  • TLSH
    T153234B1037E8823BF2BE4FB899F261458A7AF6633603D5491CC451DB5613FC68A826FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2