Extracted

• • Target
    9a5f85288613412d882ccde59c5fef1f16be4c27ac00f23357e946ec97f7daa3
  • Size 45KB
  • SHA256 9a5f85288613412d882ccde59c5fef1f16be4c27ac00f23357e946ec97f7daa3
  • MD5 e8c8b12a3435abcea0e99144579fe653
  • SHA1 8758b80ac8c6308aead8a0ab7b50aceb0da4477c
  • SHA512 e3152f07b96ed1800d81dd4910ccde7eefd5f335e594f684505025ea3ab019ce257ae6b1149e9321ad48414404ac7e30da679100a4b574d232b22e865ea26d87
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9S9Aa0yPzFOPIRzjbxga3i+wL4oHBDZ8x:0uPrpT/qY2/ydi3R3b+aS+wcohd8x
  • TLSH
    T184232B003BE9812BF2BF4F7899F26105867AF6632603D54A1CC451DB5723FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2