Extracted

• • Target
    9a36c341ae9c94ed275c8b1d30290583306a5645dccdf0ae0adf2d5626966dc0
  • Size 45KB
  • SHA256 9a36c341ae9c94ed275c8b1d30290583306a5645dccdf0ae0adf2d5626966dc0
  • MD5 4053621d5ce8a88b60c7da6424b046fa
  • SHA1 5b5046e74ea16c35dafa9b2e2274c37044c4995b
  • SHA512 1f1614f638dc7546a507b7be0c6ebe5e0f558de8e166a5a400eea482916dc6e6f049154ec2178203ef31d2154ae3e42d6c776bebecc6b0cb38e3a6779dbd604c
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4T9YiHq/zlOPIZzjbFgO3i0e/KsCIBRcN3aBDZ0x:8uUIpT4vAj2XaK63Z3bCOSnK0cN3Ed0x
  • TLSH
    T19E232B003BE9C12BF2BE4F789DF26145467AF6733603D58A1CC452975613BC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2