Extracted

• • Target
    f09f7578d1b332bb7b9de162d91782321971b53a8344ab5c6e6f0eb66022ce74
  • Size 45KB
  • SHA256 f09f7578d1b332bb7b9de162d91782321971b53a8344ab5c6e6f0eb66022ce74
  • MD5 959f84ac4b97484f7fabcd17f60b99d0
  • SHA1 fc3e2aeba9eb6f600c521eb5e073cf9accfc2aa3
  • SHA512 1c896e26743dd9716bcce14cee00c21cd855fabd14f7dd49a5749570b270069ee30a07cc2984b035df52ccedeecbe8c5630a9ba883b9376f55344617302b598e
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9nDEbHBqj2OPI/pzjbbgX3iLwtQy+KQYROr3ZBH+U4E:EulCJTHl42IyoK3/p3bkXSUtQlKRaVac
  • TLSH
    T1A9231B003BE8C22BF2BE8F7899F26145867AF6633603D5491CC451D75623FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2