Extracted

• • Target
    9c0d0a35525ca5bd5255175cfa09923317a72f1091ba31ae8985f6469cc5afba
  • Size 45KB
  • SHA256 9c0d0a35525ca5bd5255175cfa09923317a72f1091ba31ae8985f6469cc5afba
  • MD5 3e478c40ecdd3fd44d97c93cb94a8694
  • SHA1 9b40fc689dc4704c8e690e1c37b4a8c929deeb6c
  • SHA512 b5255b81cd9b6370f5b17bffff3e65dd9f9470d9b1249336c20f4411177eb48fe0b9755ccf33bb359b87f260683068ba1b183e724140a8cd95184bddd6e4a21f
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1WT9Qpm9PIUzjbugX3iTEjgsrujAOrBDZcx:RuxkJTgip2BQU3bRXSTEjgNzdcx
  • TLSH
    T10B232A003BE8813AF2BE4FB899F26145457AF6633603D54D6CC412DB5723FC69A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2