Extracted

• • Target
    e9fa220e06bbe7a197e8a82bb36cf9e1835bce616a6f5b304797479c89f2b59b
  • Size 45KB
  • SHA256 e9fa220e06bbe7a197e8a82bb36cf9e1835bce616a6f5b304797479c89f2b59b
  • MD5 ee6b890132ff37ebcaea2fb3e1179cba
  • SHA1 8476ff8153489e1cc3faa96a1a9a915bd519c957
  • SHA512 a13c763926acd3cbff65bd12474e574e49c2e7cad838aa8f9e1bad93dfdde960a351b528968c8dca6dbf0b76bfd4f25269b233d64bf1da70971ae2e113d41cff
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1opt0CCM+d4CvS8PIMwjb3gX3i5naIn3hBa3NDA0Pm:wuZ8pT1tc2x/CFWBM4bQXSRaIXa9DA0O
  • TLSH
    T117232B003BE9812BF2BE4F7468F26245867AF6633603D6491CC441DB5623FC69A43AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2