Extracted

• • Target
    9c0d94c5c0877b01760c8428b3fcaee6e3e084e7069f898a6aec7fffb2c1c751
  • Size 45KB
  • SHA256 9c0d94c5c0877b01760c8428b3fcaee6e3e084e7069f898a6aec7fffb2c1c751
  • MD5 594b7febe59501633fc19f1729a5674e
  • SHA1 9d9e3dd72e60eb16827977c8d8c265a3ceb3f804
  • SHA512 95e5e29a8191b5d13710561568dc36dfd6e753d510f4745c75f218c784458d61af7a395424db497f5b870ef7206ec10299a0591acde892a49fee881bd8fd399a
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qN1O5QSCBzHSNjPI7zjb4gX3iDyrLJZm915I2NXBD:5uSy6pTpoo2kO59ESK73bvXSef29rNRU
  • TLSH
    T1B4233B003BE9812AF2BF5F7898F21145867AF6673603E94D1CC452DB4613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2