Extracted

• • Target
    f9b9faa623549f40d245656bfe1c72739b204c8aaf030aa01e19f1189fab767e
  • Size 45KB
  • SHA256 f9b9faa623549f40d245656bfe1c72739b204c8aaf030aa01e19f1189fab767e
  • MD5 24395ced0b90cbdb7cc52445ea11c29a
  • SHA1 44c6b71c6284c4198d55fa54df63b9f108020b02
  • SHA512 15fa366d026dfa5a61a7aaf79964f63db3a138bcb42efe5559d58abd134a85abf66226697a1e595e5b5dc5b5a74eced01687dfedc7592e4a40576a4e8e1ac83d
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4wO5QPCBAPSNjPIRzjb+gX3i+i8hXJdp7gvmpOBD:8uUIpT4vAj20O5svSKR3bBXS+i8xJ77v
  • TLSH
    T180233A0037E8812BF2BE4F7898F26145467EF6673603E5492CC452DB5723BC6DA426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2