Extracted

• • Target
    9f83b4a1bc087ed054acce23f45c209fd4dd55b3a36bd0f9fc5118b112760712
  • Size 45KB
  • SHA256 9f83b4a1bc087ed054acce23f45c209fd4dd55b3a36bd0f9fc5118b112760712
  • MD5 1e886a7d791c36d6454b35a73de4f8ba
  • SHA1 ef40b4e4962a1587ca7dc6611704b31941c6669f
  • SHA512 54548b8d44ad9d5f450ae699bae2fd7269ff053f807b394c4477960fdd1c3625f0fdb18993ab3632c920e1357bbf601868ca1f4b0916f02d4362f4033def7723
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAmmaPol53APIkzjb8gX3if8tazRvImoBDZcx:UuKWgSJTwRf2Wfob3lk3bTXSf8tLZdcx
  • TLSH
    T151231A003BE9813BF2BE4F78A8F26145467AF6636603D64D1CC441DB5723FC69A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2