Extracted

• • Target
    09da97739d12612b0497b463db8ec61b763ea273c99c091117cab4b1e3492d42
  • Size 45KB
  • SHA256 09da97739d12612b0497b463db8ec61b763ea273c99c091117cab4b1e3492d42
  • MD5 adb3caa85817691705d995ab173a4e2b
  • SHA1 e8840f6fe5f4d93582946d6bcfcb6c255d59a10a
  • SHA512 96ce2a813d34ba8d196b924f4566b382942c155bef59f9434196c3cd794c9dce1000210533758c60f9177822e51a3839412b394faec209d6acedeef724ad2dd2
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9T9YS3qXxOPI0zjbEgX3iWp1vJ7FQ7vMeQDbHBDZsx:EufspTf2g2+aaq303bLXSYdFFQ7vS/hc
  • TLSH
    T186232B003BE9C12BF2BE4F7899F26145467AF6633A03D6491CC451DB4713BC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2