Extracted

• • Target
    d9a855985ee725d6a8d0af2f2b32e155e8ba9d1ad55149e574c582062b0f7d4a
  • Size 45KB
  • SHA256 d9a855985ee725d6a8d0af2f2b32e155e8ba9d1ad55149e574c582062b0f7d4a
  • MD5 3eed889fc4db4ecd1d3d0a0fb875d411
  • SHA1 a86379f94810d7686edcd763712d45b8eb61b005
  • SHA512 bb6be1052de925538db8eb1839c36d7b72085dc21a17fd5343c5d0a64d07f7058e635532fc230ea965d6b86301ce3b0e611406aee96aa691982a7d38c06901e7
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVe8V1RpPEcPIMzjb8gX3iMpRXO8oygBDZEx:MuBGJTPho2t8VDZEhM3bTXSSodEx
  • TLSH
    T154233C003BE8823BF2BE4F78ADF26145867AF6633603D54A1CC4519B5613FC686526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2