Extracted

• • Target
    9045baf7d4124271bcaf495c6eeaa3aa1964323838bf4707fd576a0530006ada
  • Size 45KB
  • SHA256 9045baf7d4124271bcaf495c6eeaa3aa1964323838bf4707fd576a0530006ada
  • MD5 76913fa5db8f0ce5efe8092bf19b8550
  • SHA1 9f788bb651afd9b8e728b7519b18be77108f5398
  • SHA512 2c594c45d1faab26764d8a5154cf752a42bee0d0849efd186525f5bece3e827888180bf339d9e0569b877e653b9d5d681d51248c14a8bdaa11466e7537186c1b
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qV2maPcl83APITpzjb1gX3i3tjXD/GpySdm/DEqnmNpo:suJdpTPdI2HfcS3lTp3bSXS3t7D/Wdm5
  • TLSH
    T1ED232A003BE9813BF2BE4F7899F26105467AF6637603D64E1CC452DB4623FC69A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2