Extracted

• • Target
    009b0e87975068041f6e03301e950a7cd73ec5098d172de4ea7cd599493e7866
  • Size 45KB
  • SHA256 009b0e87975068041f6e03301e950a7cd73ec5098d172de4ea7cd599493e7866
  • MD5 9e84a31438a531f05533f79c3a0a26fd
  • SHA1 72573e5f4f593bc6ebf3367b07c4dda5a616bb8e
  • SHA512 858ac4c8959d2c56fbf5fc016facf92615114b6f79046db3f9111fedda65648d829fa84279135a78615a6a216e7f40c213e8b2aabd3c67a644b151724353597f
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVyqJaxjwHuPIPzjb7gM3iXc3xN08IBDZkx:suJdpTPdI2H3+3P3bEMSMBFudkx
  • TLSH
    T148232B003BE8812BF27E5F74A9F26245467AF6637603DA4D2CC452D75623FC2CA426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2