Extracted

• • Target
    9a7559a33707ce7fc37ccebc2a66ba902b2d18868e0348a6815aeb8c778c9ed0
  • Size 45KB
  • SHA256 9a7559a33707ce7fc37ccebc2a66ba902b2d18868e0348a6815aeb8c778c9ed0
  • MD5 4ce941be28dd09e194ba73329b139d88
  • SHA1 2ee6a41d411c84c6a7a9d74cbdc351973331c982
  • SHA512 33a7a62eba5a05700b0f484727484336f2f5e3a9e6b12366cd2347cd5d62b6a89b02292e85aff57dcfceed3e94be014f24569d4566e1f7d826df2d33f4b9cc6b
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qF7fBohEa+PIvLjbggX3izux+aL7PfgfHyBDZUx:cu7e5TH2A2q4EaHvfbHXSzuSHMdUx
  • TLSH
    T12A232B003BE8822BF2BE4F78ADF26245867AF5732603D54E1CC451975613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2