Extracted

• • Target
    9ced648b525e0778c94f8466972325ae3734a2f0d564b1cac6c57c36f0b5bf13
  • Size 45KB
  • SHA256 9ced648b525e0778c94f8466972325ae3734a2f0d564b1cac6c57c36f0b5bf13
  • MD5 a199c4abbbcfde5e938136aa6f675252
  • SHA1 914f8887aa03a9ba454eb61c63d3a216ab803f22
  • SHA512 baf2c47d2d782c527dca4f069a2895fddffdb8a59fcb530a54840c1588fa428c59248eb94094ff09c7425fe36460def5efde704566447e9bfc20374f2ad8a1c4
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtgDEbHBqjSOPI/XzzjbLFgX3iTQfT3F0yXtkmsBDZ0x:5udApTNmU2fyoO3/Xz3bWXSkey9ed0x
  • TLSH
    T14C231A0037E9C22BF2BE4F78A8F26145867AF6633A03D58D1CC451D75613BC5DA42AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2