Extracted

• • Target
    9c46957b00ca28852b8403a8c544a2119aba71068b08e525d708df82f1fc206b
  • Size 45KB
  • SHA256 9c46957b00ca28852b8403a8c544a2119aba71068b08e525d708df82f1fc206b
  • MD5 5bf84c1b71998a0da857ddf6b935c929
  • SHA1 a89e938a4a8bb36e4a41680901b8f7f17de19b3c
  • SHA512 345a41c0001cd391b98d5535921f1fc34f037c6d32099c6d9d0efef4aafd9ea29ee5b75ed1904c423a645a0add05d1d5ed83f3b708a057d6a930fe24436178c9
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFvZTohEaSPIyzjbZgX3iQRXBmZiW5heHdBDZEx:MuLAZTnbg2O4Ea7y3b2XSsBmZiW5oTdG
  • TLSH
    T1C6231A003BE8812BF2BE5F78ACF2614546BAF5732603D58A2CC451DB5613FC6D6426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2