Extracted

• • Target
    9bbd3929f0006fed07c4cb39e0db0d22543d90262fbb1ff353ac36ead43c3819
  • Size 45KB
  • SHA256 9bbd3929f0006fed07c4cb39e0db0d22543d90262fbb1ff353ac36ead43c3819
  • MD5 a3d5adcb11089a0f5981fbc0bccd71ce
  • SHA1 b12ff8b07a3afcfe2c0fe17f0062e10208cc3f74
  • SHA512 71b21dff3c6fec8db3ab9579a4f50b9ceb99f8212a52c0c9fca59a4e6afa84f9a2ef820ee9d4841ace7b1e966db12353a833124244f1d6a0a77ace1e904a89bb
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1NqyE0OFUwdJxIkDPIdzjbRgX3ixvrn/eRGnv6WpFB0:cuR0JTPjY28qNTLMd3beXSxTn/eRGvbW
  • TLSH
    T1D2231A0037E9812BF2BE4F7459F26241867AF5637603D64A1C8441DB5B23FC69A43AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2