Extracted

• • Target
    9dbb8f271593cb81f1ced55273bedca5256ca9fda8f833b396d9e2371dc90247
  • Size 45KB
  • SHA256 9dbb8f271593cb81f1ced55273bedca5256ca9fda8f833b396d9e2371dc90247
  • MD5 42e5456eafb96c18fc737eb263e78fcd
  • SHA1 211ea2b4f86618cc9a6f57d7dbfa5a858605824f
  • SHA512 90c6efa4dfabe4cfc842bfc4ab9153dc2c050919c4fb252d84d1c07c39783b92a43e4499a650dacf602e571a65e5572c5c6cbea74b2131a1172433e775569fef
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qV+xJaxrPHuPIHzjb2gv3iYlw7DisRkYdR6BDZkx:suJdpTPdI27eR3H3bpvSYlwniKdRkdkx
  • TLSH
    T1C4233B003BE9822BF2BF4F7499F26146467AF2637603D54D2CC451DB5623BC68A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2