Extracted

• • Target
    a9c2f4c2bfea5331766321e98a1d6bb202f0cb4ab0dc731d712b84ae8cf35eb2
  • Size 45KB
  • SHA256 a9c2f4c2bfea5331766321e98a1d6bb202f0cb4ab0dc731d712b84ae8cf35eb2
  • MD5 900e1912c037c2246fa971a308ede742
  • SHA1 1757bb4e33615ebab1ca5098f4406a9905cbd199
  • SHA512 1aa0e49f80b4ed34d1ff43403c1c45149e7f75728bb9adcf165e7a9042ff8ae093ae83fa56224fae8de3289ee5e086f8bdb438ea0ae1253afb5b5219c276ee65
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9i9oSsqHz1OPIqzjb+gd3iFBzUVRAZndrtIBDZ8x:0uPrpT/qY2/Kti3q3bBdSFE4Sd8x
  • TLSH
    T1C3233A003BE9C12BF2BF5F7899F26145467AF6632A03D54E1CC4519B1723BC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2