Extracted

• • Target
    9f79c3a9f409550db2b69589cb1ebf49bbfa893d0c43c654943a6b481e5aedaa
  • Size 45KB
  • SHA256 9f79c3a9f409550db2b69589cb1ebf49bbfa893d0c43c654943a6b481e5aedaa
  • MD5 803df4871b172e0bfa46f8f58383c31f
  • SHA1 fd6f43e54b18a3013c9dab463d03cf09aa8e4afe
  • SHA512 0110633d1ef4c1b4d254c6c31b8798ae200459c5a190deb96dd76d656d90d8ddfc67af5ba71a54091caba61437849cbae0c41a35076c8e464e45fcf812a6af8a
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYj583IkOPIdzjbVgY3ih5z6lYVG15VcPBDZ0x:8uuSpTgyf2tAF3d3byYSBM5Vc5d0x
  • TLSH
    T1DD232B003BE8812BF2BE4F7898F26245467AF6673603E54A1CC451DB5613FC69A427FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2