Extracted

• • Target
    9eb191cf0d8f57d3ec661cb11d23dc27e885bbe48a0efec6d97c7c6427d84d79
  • Size 45KB
  • SHA256 9eb191cf0d8f57d3ec661cb11d23dc27e885bbe48a0efec6d97c7c6427d84d79
  • MD5 0aff148f75988adf52da7255c3615ab0
  • SHA1 d5483a89cdbc9d1cce8a2a09f677b3e00c2fbed6
  • SHA512 adbed5a2a7e2f1db5af285cbc8bc031ac3954e6f58e7b7a0f3250dcbeeeee807ff4ea30f47f2c0546ee75fe336e443be939de41c111210c014ec217b2d9f68c3
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNHoopCBK9INJPIZzjbJgX3iLGJbmLuhLJlTL2wBD:5uSy6pTpoo2So6bIwZ3bGXSqbbhLnL2x
  • TLSH
    T143233A003BE8822BF2BE4F7899F25145467AF2637603E54D1CC4529B5713FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2