Extracted

• • Target
    f9fc2452935e68adfe844dba8f3e6de889e6172119b687d90c462c5709e8f703
  • Size 45KB
  • SHA256 f9fc2452935e68adfe844dba8f3e6de889e6172119b687d90c462c5709e8f703
  • MD5 16396c4899d204838424238036112cb8
  • SHA1 2b225da57e6a5ef8d24aa3bc8d6c2df43e7fc7f8
  • SHA512 7a0ab0d616dad70dfa3da3a154bb14d74303507b0668b40b7d946ba9a35bc10cb7ff4055025c9e6d87ed466843d810b72ccde1ceb8fd0714ccc1cb04158a4fff
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9jZoQTMtPI4Yjb1gX3iJDZLTRFHpIJcxBDZ8x:0u1YJTHcw28L34QbSXSJF538cPd8x
  • TLSH
    T13D231B0037E8822BF2BE4F78A9F26145867AF6673603D58D1CC441DB5613FC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2