Extracted

• • Target
    9734bc6c1dba4e0fdffce70a4a521574a14d8254e400f7206e54f668730d1a6c
  • Size 45KB
  • SHA256 9734bc6c1dba4e0fdffce70a4a521574a14d8254e400f7206e54f668730d1a6c
  • MD5 bc1ab95cd7a2ac81c6640c73a63f1e56
  • SHA1 6a58807d553de5bbfb371dbc2f5ba57a354a50ff
  • SHA512 f254397100c75924f46324455d422d4abddc799addf20b0eaa4f9207b1ec514e2376ea1d76676fb1b0da774ddaf946636c1f8f03290c2eef94e9239c6a70f369
  • SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qroxGZGP9HuPIFzjbxgk3ii78YgWAMVS3ezBDZkx:vuogpT7I62DGa3F3b+kSioWAMVA6dkx
  • TLSH
    T10C232A003BE9822BF2BE4FB499F26145867AF6636603D94D1CC451DB1723BC6CA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2