Extracted

• • Target
    9d0ccbd44d39a21e865cc437b3a7951f27ecb32d3e4395a31d02dbfafad8f366
  • Size 45KB
  • SHA256 9d0ccbd44d39a21e865cc437b3a7951f27ecb32d3e4395a31d02dbfafad8f366
  • MD5 e8de1e368863bc13e25c8a11210173c3
  • SHA1 2f01cedb15e6c36ce04557a5d5c184d6a809621a
  • SHA512 1a9dfe800f7868c0cae1cc59d8c3d40fd5ce64b5757a070bf1f67b54419d47fb97524ad1723cd053e3cbb9bf86389977a59e331ec2a99be1b0d848f8cb063eb6
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qF4ZTohEaSPIyzjb9gX3ivDEjY+LR0hEx8a30BDZUx:cu7e5TH2A214Ea7y3bqXSvoDLRRx8aS0
  • TLSH
    T121232B003BE8C12BF27E4F78A9F26145867AF6636603D54A1CC411DB5713FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2