Extracted

• • Target
    9c344d2cdb443ed0f2d8185a2d360fa0cd608755e5acc4b791d8cdd607fdca73
  • Size 45KB
  • SHA256 9c344d2cdb443ed0f2d8185a2d360fa0cd608755e5acc4b791d8cdd607fdca73
  • MD5 1aa8b2046efc986f6ae4762ccdf07984
  • SHA1 b21a58126441c2ae8fb333751f6c813490dbb95a
  • SHA512 8e3751dea08543b5efbd5e5683205c4806df2d01bf19411f886c947b851ac4fcd3d94ba4f353755f2ad8bf92d7e38884867943e33c6f0796c72d9efe7ad9bcf2
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qF33Fo9EaOPIazjbfgX3i8ZpGGP/YBDZEx:MuLAZTnbg2C8Ea3a3boXS8xedEx
  • TLSH
    T1DD232B003BE8C12BF2BE4F789CF26145867AF5636603D5891CC451D75A13FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2