Extracted

• • Target
    9123ecb71f6e95b0c45d15f5ff0b9cf96a4ded3b49c5c44caae77918ff9a9129
  • Size 45KB
  • SHA256 9123ecb71f6e95b0c45d15f5ff0b9cf96a4ded3b49c5c44caae77918ff9a9129
  • MD5 9f121ff3903f10cf67274cb4c9f4da7b
  • SHA1 b90540a786e75a18fcaf0d0b3b6f091c6d5d2ab1
  • SHA512 b20d6dbcd50d7758543ae3f6ec49215b49f4255591c7145f1b72a345ad2857fa9571da9dded2454a4fd7ae992a99c009202fe5e8367c7e93f83ffcdd9a5d4a18
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9XozHyvCKPIiMjbdgX3ioMEWPgftdkj8DBDZ8x:0uPrpT/qY2ZL5i8bKXSZfYftdGWd8x
  • TLSH
    T1C1233B1037E9812BF2BE4F789DF26145467AF6632603D64D1CC411DB1723BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2