Extracted

• • Target
    fc9b39dd4ea1bc940074a90aa36f1334b8c6df2032e8663444be17c6c8d1206d
  • Size 45KB
  • SHA256 fc9b39dd4ea1bc940074a90aa36f1334b8c6df2032e8663444be17c6c8d1206d
  • MD5 3a17c8f4d77a4a117a4c77cfa2633565
  • SHA1 57d456dbbf86653661f0f4efaf1cef470d3f1f45
  • SHA512 c4ce042e892d387c423f48254df92e355a0b0657a3c50b440ee2f92c81d00f8e700ea999f4f46bbf498da76290cd017b4c5e3b11b0cb7f4b447454c68e449592
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVOT9Qpm9PIzzjbdgX3iIP7LrgalP1EdKwyBDZkx:suJdpTPdI2ZQz3bKXSIznga5ecwMdkx
  • TLSH
    T1FC232C003BE9C23BF2BE4FB899F26145867AF5632603D54E1CC452D75623BC58A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2