Extracted

• • Target
    c9e43843be94e63891767c8f5bb7bd83ac89bba832b78137477b4ad247d41d21
  • Size 45KB
  • SHA256 c9e43843be94e63891767c8f5bb7bd83ac89bba832b78137477b4ad247d41d21
  • MD5 e75fc64a656f380a1f8c28193f4b66df
  • SHA1 3f7e95720fe1a7b815030d0d4b6113e4066520bc
  • SHA512 30749fd6c9b4c27f773ac16605afdb9248da1c8278f82f38e3d71f64f27454e8a4b00a95b4352f74c834356b119d17beb7829d0747f205d4b525651629d3f978
  • SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qr8uwZQaKkPI+zjbAgX3iGyc6HkIYBDZkx:vuogpT7I62hI+3bnXSGylkddkx
  • TLSH
    T11B232A003BE9C12BF2BE4FB899F26145467AF6636603D9892CC411DB5623FC6C6426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2