Extracted

• • Target
    9cb1b6172ec000f798809e9d2bf73e64cec0c0884bf8c43f1c3172b868b89153
  • Size 45KB
  • SHA256 9cb1b6172ec000f798809e9d2bf73e64cec0c0884bf8c43f1c3172b868b89153
  • MD5 c115d2ef13749a57297db67e69773de0
  • SHA1 4bb5b410eda3b31960ece4ec5e0dcf78098e9a28
  • SHA512 3f496c9abacf5f83b6d939ee00d885a088b5d6841767cb5efd92c6c595968cd38353e277801cea297035db1ddea98f35b253119a3f32343e2e78217508f337ba
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qV/0VllVc6GcPI1zjbjgX3Bu2Wt0QqYjWPe8NBDZEx:MuBGJTPho2Q0V/26Gh13b8XxuDeQ1jWs
  • TLSH
    T114233C0037E9812BF2BE4F78A9F26145867AF6633603D54A1CC441DB5623FC6DA42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2