Extracted

• • Target
    9b4a17cce1ea848a06ec569b2e0130ea38728731b357719dc9a34af212c21c00
  • Size 45KB
  • SHA256 9b4a17cce1ea848a06ec569b2e0130ea38728731b357719dc9a34af212c21c00
  • MD5 9e51ccd95f6b2acf0bd129ef7ff1fdb4
  • SHA1 15bafa76f27381d74c55fa0cfe57f58afcd4be47
  • SHA512 2d0b4c50675b6bfed41c1a0194d7870f773113124269ac9224c186b0c62cf1867dc985014882e3b3e27cb885aeff8ca0a9e3505447eb63f9d724bf190b63a7c7
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtm/cYssPJZOPIcvzjbjgXwiCnPIJ8IGNuq3fjQHRmoq:5udApTNmU2ZMIf3cv3b8XNR1GNjwmolU
  • TLSH
    T12E233C0037E9822BF2BE4F789CF26145867AF5677603E68E1CC441974613FC696426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2