Extracted

• • Target
    9a18366c9e8ae2a00102306ef4bc99f57d12d414a2d08901fdb73becb8ab5166
  • Size 45KB
  • SHA256 9a18366c9e8ae2a00102306ef4bc99f57d12d414a2d08901fdb73becb8ab5166
  • MD5 948fd1291c2403552e4f57de0de56375
  • SHA1 1df6c4c79f0ed90160aa39571eb95434b580c56d
  • SHA512 950bdf86bfdcffb9a7c61637ba6779ea6ca4e059fa612394232f391b6920cbc456ecce823785a5738ba4b2e681fabb170d6d0d0319d990df360b8f099baa266a
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q98zjHy/aKPIbNjbugX3iShGqze2RBDZsx:EufspTf2g23nhbFbRXSShGqzZdsx
  • TLSH
    T1E7232B003BE9812BF2BE5B789DF26145867AF6733A03D58E1CC4119B1713BC69642AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2