Extracted

• • Target
    f9ec5eea76233ecb91b188f25183de475c3bf63bfa3e85b48da40776755a0c3f
  • Size 45KB
  • SHA256 f9ec5eea76233ecb91b188f25183de475c3bf63bfa3e85b48da40776755a0c3f
  • MD5 0416c9acb87f2249d01a9d9bb6057596
  • SHA1 4ecfd782fca4aa60b34b4aa8be591f01cb4e9a83
  • SHA512 e4b2a753ec6dfcff34cf21c115d1c659a9583df933868e3a4612f33246f39b082f15db4a560afa1508485b3c45dc76d85d4812bc7f12944f6df42ce52ebbcd5a
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4UzjHy/aKPIbbjbkgX3iAZ+ofdKI6+nG0NY3vFkBU:8uUIpT4vAj2wnhbPbrXSAZtfxsqAwd0x
  • TLSH
    T1CF232A0037E8C12BF2BF4B789DF26145467AB6633603D68A1CC411DB5613FC69A52AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2