Extracted

• • Target
    9b2b7a580ef14adf8c7cc18452e66b2caed3384c6710bc771f465a9e1d4e1b09
  • Size 45KB
  • SHA256 9b2b7a580ef14adf8c7cc18452e66b2caed3384c6710bc771f465a9e1d4e1b09
  • MD5 891870b6d0c170f9db45829a04efca40
  • SHA1 ba3dcab431b7697c0835c576f3e51a7a508866b0
  • SHA512 4ab05224a26f3c00d442cfbd9243f18ff910fce1d01fd7d74e96399fc8907b4fc95df9c6fa018a6ed14d44c7dc8a3feae10d84e016ad411f2ba87782679c7167
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2ql43FoDEaOPIdzjbrgX3i244Nzxkd+yxlDXGBDZMx:wuDWZTpMZSB2JKEa3d3bUXSWkAyP4dMx
  • TLSH
    T1AB232A003BE8822BF2BE4F789DF26245467AF6732603D54D1CC451DB5613FC69A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2