Extracted

• • Target
    9eb6f598def3396c7879aa8729091253ce413c10de2a9c5ea5f214624c8b972a
  • Size 45KB
  • SHA256 9eb6f598def3396c7879aa8729091253ce413c10de2a9c5ea5f214624c8b972a
  • MD5 06d8726265fab43a1635a546a96d0480
  • SHA1 e700a56e0041ac3f17edef449cac39be4c64c94f
  • SHA512 9dc3f29397fde1b3dd161f04a4dfc277d6ebb22bdd0bd23a1ec3b57e878e3e13c27c04966c2d1c19b2085e77dcef64376a7508dce509c15c943b2cf23f011c54
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVj0b3NLAteiZPImzjb4g53id3+1LQzIejWBDZEx:MuBGJTPho2/3ZhiWm3bv5SkQ0eUdEx
  • TLSH
    T17F2319003BE9812BF2BE4F78ACF26145867AF6676603D54A1CC451DB4623FC68A436FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2