Extracted

• • Target
    c9cc4f1ec9f65497142f9be7127681e898a5dd0237085c35ef8cf9fc0697ef6b
  • Size 45KB
  • SHA256 c9cc4f1ec9f65497142f9be7127681e898a5dd0237085c35ef8cf9fc0697ef6b
  • MD5 c72fa1433ef4b7edcc79bc5ff99d2650
  • SHA1 3b347c2d059dc9c2738568aa6f02cb21358f0ee5
  • SHA512 9233c237b776c96a1c8b5237385e588a63ae55a40feb0dff7c05f586d19249a158cfcad8bdb588ea55da66e31930ecb23a5ecfa1c8ecb3c2def26ffcdd879f4a
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1swZQcKkPIRzjbJgX3ibEfAz8i54SvSUruWBDZUx:cu6YepTPso20qR3bGXSbmAzH53vSAdUx
  • TLSH
    T191231A003BE9822BF2BE4FB8A8F26145867AF5637603D9496CC411DB5723BC586426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2