Extracted

• • Target
    9c43cc5d0738bc359821f12450fdfa402d69d7a5b970ae90dfb976ce1cfca5ce
  • Size 45KB
  • SHA256 9c43cc5d0738bc359821f12450fdfa402d69d7a5b970ae90dfb976ce1cfca5ce
  • MD5 fade2dc05b5a6214cb10220db36e22fd
  • SHA1 2c9abe0a66ae1f62f6dfa43f0eb9146d3c4b249c
  • SHA512 d4703e70388884fdf3cf6d2bd72bf239cbef07232c6ce945a99ff861421a22f05e723f52b7ab073528505c4276addc2fd6b81fbb95eeeae7a515168974db4b06
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qw55dTQy06SOPIMFzjbwgXXiErCriT55RoGrPBDZMx:ku40ZTXEb2jmaS3MF3b3XysHB39dMx
  • TLSH
    T165232A003BE9812BF2BE4F7899F26145867AF5732603D58A1CC441DB5723FC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2