Extracted

• • Target
    9869a5d085285e9573ce496bcfcfac3daf864b980d259ead153139e0952de89c
  • Size 45KB
  • SHA256 9869a5d085285e9573ce496bcfcfac3daf864b980d259ead153139e0952de89c
  • MD5 b902f2949caa05e76255fd096ce8f994
  • SHA1 a382fbfa56e1bb1dd714da20402f351b178c42d8
  • SHA512 6277b0b78413f80f74c3372b07a18039f7fc414d8d30b282a57bb5149b653c528a5e1e82641cec194d1da9e0029c287f48293e089ea5a4f7069e092532865cac
  • SSDEEP 768:4uBfJTMUyYUWUWBDimo2qV3fkLyuObvtkjZPIuzjbEgXFiVzi9qftyUEMFUB3IB/:4uBfJTMpv2+fLuyyjWu3bLXUVzi23vdV
  • TLSH
    T161233B0037E9812BF2BE4F7858F26145467AF6673603D5491CC451DB5A23FC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2