Extracted

• • Target
    ca9ea29fb4dad636fba933daaa1dc98555fabf2eb03a81e6be2b16aec652166d
  • Size 45KB
  • SHA256 ca9ea29fb4dad636fba933daaa1dc98555fabf2eb03a81e6be2b16aec652166d
  • MD5 99948a7ea94d9c1bf44e0bcd6824c11a
  • SHA1 a2fb16b30f963af0e653091aa3148c546b6d25c5
  • SHA512 d6d42207678cdc7172392856e67abbe2060a7c7b2717b27b200f1fc2cea261949b6e38e77eaf7e2987deba7125a8f21480aa594659913a7a1261106be1fc7a47
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYZ/NYssPJZOPIczzjbDgXWiayhb6glokwu8LpQBDZ0x:8uuSpTgyf2hHIf3cz3bcXfayhNuGd0x
  • TLSH
    T131230A003BE8812BF27E4F78ACF26145867EF6673603D58A1CC4519B4613FC69652AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2