Extracted

• • Target
    c9ce85e45e0d94f5a2295f38e5118cf83feb234bd08fe57b5418bcab480bf29a
  • Size 45KB
  • SHA256 c9ce85e45e0d94f5a2295f38e5118cf83feb234bd08fe57b5418bcab480bf29a
  • MD5 12ed8e4546fe4b885c0cdc839913ed34
  • SHA1 96a7039a947f0a7f742d76d94b540ddc962e97bf
  • SHA512 c252075e3c621db81bf1c50a35be338872b9ccdbe3749addf8cd437541af1d428befc638c755ee0aafdbed5f4243fb4939e7fefa8d3673971f5fe5d266d50c05
  • SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qrXmaPcl83APITpzjbMgX3iVX/XJTlm69PBDZkx:vuogpT7I62IfcS3lTp3bDXSNXNk695dm
  • TLSH
    T104231A003BE8813BF2BE4F78A9F26145467AF1637603D64D1CC452DB5A13FC69A42AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2