Extracted

• • Target
    f9a203a674efc1f86494e50b21176c5afe4183c182da6f877afefada8c8f1ee7
  • Size 45KB
  • SHA256 f9a203a674efc1f86494e50b21176c5afe4183c182da6f877afefada8c8f1ee7
  • MD5 f4823c036359ad888e63ef672df576c6
  • SHA1 3b2e8ba95016e90eb2f0dc9f7fbca4a71cc5b118
  • SHA512 89d95bae73f287c5833d6211af68ae5e3243d3cf675ecfff71c7ae29ee9eb416b8fd026386d35c64f9f0bdb0c2fd32b67d858687cff6a381091fb0377f0b3b83
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4DqTkafz+OPIEzjbKgX5iTARQRlSmyKRrKDBDZ0x:8uUIpT4vAj2HqoR3E3bdXITmOlSgid0x
  • TLSH
    T1A3232A003BE9812BF2BF4F7899F26145867AF6637603D54A1CC451D71623FC68A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2