Extracted

• • Target
    0b9aa9ad670720973fe5072ac6a1e9acd587b0a1dbea329ff71758e93f0f1361
  • Size 45KB
  • SHA256 0b9aa9ad670720973fe5072ac6a1e9acd587b0a1dbea329ff71758e93f0f1361
  • MD5 a97d11c24c69f38c9a47370b17c15d22
  • SHA1 7cc846687c9f2391705bbc788e8b1c0df9a64a5c
  • SHA512 3502691e55ac1e6ab66c6a439d352abb8e5d0d5b66ac490aebb09e5ba7fed290178df865b88a7ecf4fe51d93067fbd30ee0f8002e9a60c930761ad55167d46e7
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwshk6K7OOPIzzjbVg63i0/MoXovXLfDwOxeBDZMx:ku40ZTXEb246VO3z3by6S0/MoXSLfbxj
  • TLSH
    T186233C003BE8812BF27E4FB899F26145867AF6637603D54A1CC451DB5B13FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2