Extracted

• • Target
    f0c9a4df74e6016fc6fd4c83ab1ca707edd7653f8040d60974483707f2acc287
  • Size 45KB
  • SHA256 f0c9a4df74e6016fc6fd4c83ab1ca707edd7653f8040d60974483707f2acc287
  • MD5 2c23a78f6f0b204aedfab63f827c5500
  • SHA1 bfee2075f8e192d09de690bf93cdce0b9cb82eb7
  • SHA512 ffac5bcb705ae8f96962e01d14be4efa9e09737bc1a11c305c3ad7112572d82b68587088f3862ac31bc9e8fcd40592bc61061e95c6aac16b840b0517dcd10677
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVJpt0CCM+d4CvS8PIk0jbXgX3iUkPBtBRONO+FBRpm:MuBGJTPho2Q/CFWBkUbwXSUkyNhdEx
  • TLSH
    T1E9232B0037E8812BF2BF4BB459F26245867AF6732603D6491CC451DB5B13FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2