Extracted

• • Target
    39cbb463d9fcff245b925821b0ed692e25d4f6cab9e5296bc303e0fbf8a6767a
  • Size 45KB
  • SHA256 39cbb463d9fcff245b925821b0ed692e25d4f6cab9e5296bc303e0fbf8a6767a
  • MD5 9c39937fe1acf364bf29aad947691e61
  • SHA1 ff0770eaf8e3bbf62e65c820cbc4b38fa7b5d3d9
  • SHA512 c9ed537ac9c0b344c78f85ba46ae7540cfe8d7b67320bde29753d7565ea6b04b9a551f931ad79017ac3346106e933577e6be61153bda6732b69993f8ea17e10b
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVDI0tnxHuPInzjbigXBim2bPjXuN4jBDZkx:suJdpTPdI2e3r3n3bFXQDPtldkx
  • TLSH
    T1B6233A003BE8822BF2BE4F7499F26145867AF6637603D6491CC442DB5623FC69A436FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2