Extracted

• • Target
    9c7388244bdf1b15886fbbf59fa4b6f8d9fed8302624d8795a3d8e3e932c6601
  • Size 45KB
  • SHA256 9c7388244bdf1b15886fbbf59fa4b6f8d9fed8302624d8795a3d8e3e932c6601
  • MD5 b00cce16e59648c4d6ab218ca2f75afa
  • SHA1 0db145bdc364d9424c73aff370019c57dd409d68
  • SHA512 a66f97b3a860cdc929fc6a1678e5ad2cf342c4b84904a237e94269b9fb529800846bf547b1bfd11bc793f993ad6230ca435d655edd76717e7df62e982a303dad
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9zzjHynaKPIs5jbWgX3iiI05/uMoBDZ8x:0uPrpT/qY2QnZs5bJXSvau9d8x
  • TLSH
    T147231B003BE9C12BF2BE4F78ADF26145867AF5633A03D6491CC4119B5613FC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2