Extracted

• • Target
    0c9db5ba16a947221f99beecfeaf164a0d3d352780a12f95fd4a56a33fa0c2ee
  • Size 45KB
  • SHA256 0c9db5ba16a947221f99beecfeaf164a0d3d352780a12f95fd4a56a33fa0c2ee
  • MD5 ff3037f57035902b9e2464e6bbb3d586
  • SHA1 4345d82a57a2cf09fcaacdd8bc7542ffed8f7db5
  • SHA512 c5740e0ea6b37b767a09f225b6c0aa69e89818e1c3e8572260097ba093186c58cd0e444b0ddc7134051f02ef47e4ff7cec3b285cbeccd3d3399d7086cd4268b1
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q98zjHy/aKPIbAjb1gX3i/d9NLqdh+t4DBDZsx:EufspTf2g23nhbobSXS/dy+tydsx
  • TLSH
    T1FA232A003BE9C12BF2BF5F789DF26145467AB6633A03D64E1CC4119B1613BC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2