Extracted

• • Target
    e9a9e4cd74bf85c457947cdc34d07aa85b9b932416c0f4be69ad4e7632a721c5
  • Size 45KB
  • SHA256 e9a9e4cd74bf85c457947cdc34d07aa85b9b932416c0f4be69ad4e7632a721c5
  • MD5 098f8da5f82da0fbb94bacc85efaef46
  • SHA1 eafc26bfe601d4b28cd8c88d12b5fa9000cec6a6
  • SHA512 d6035bbdfb44f3b9b6ffc76f62b68328242f20d83327f0e4f604c62d706a2a9a31932420d4ce3b445346089589199171aa8c803879f05e581b32cc5076e04be9
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAaLiE0yFjrdj3kk8PIh6jbzgX3i8y9ZTabD2DwqRa8V:kuSOpTPOP2KLBXDBhWbsXSJubDywqRxV
  • TLSH
    T128232B003BE9812BF5BE4B74A8F26145867AF5733603D6491C8451DB5B23FC68A43AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2