Extracted

• • Target
    d9d5d9cb0895e706906ec373f647e84543c8ae39406d89d3a281b22397927d71
  • Size 45KB
  • SHA256 d9d5d9cb0895e706906ec373f647e84543c8ae39406d89d3a281b22397927d71
  • MD5 b6aa428cb908fe556e03df718f0d22d1
  • SHA1 8d2562cc49bf1b859de70e34d2c7165f700f6bf8
  • SHA512 e2c109b1ac92e97ef1bc3bb29a6e106fdf69d1f72d4d5ac4d7f9208e2d9a1f266fd102bcc97bc9352a1d0e452b62c7e3dc81c92b80968e5c21b6b51dd25f1ed4
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1/BzCQKx7PImdjb6gX3ipwPY+EpdBDZUx:cu6YepTPso2+o0m1btXSpm8zdUx
  • TLSH
    T1E1231B003BE8822BF1BE4BB8ADF26145867AF5637603D54D2CC451DB5623FC686426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2