Extracted

• • Target
    9f5eff2dfd5ed4eeebea4d61f7089b51f075c07042a6c6639fcbc25b23fc5ae5
  • Size 45KB
  • SHA256 9f5eff2dfd5ed4eeebea4d61f7089b51f075c07042a6c6639fcbc25b23fc5ae5
  • MD5 a13664657354a833a496b8c667558d51
  • SHA1 1c5be0ac954792add168f979313405e90a4493cc
  • SHA512 b1a9742943736b1a1c327a7a37819deb2486f50f2cc322e78db7fd6395c06946b3fa58a39125803674157429b1c27fad1d600bedd321c55bd3190a6706baea13
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1K8V1QpfEcPIYzjb6gX3i1oS0o91KLjK+762qdjrB8:wuZ8pT1tc2x8ViBEhY3btXSino98Lu+l
  • TLSH
    T15E232C0037E8862BF2BE4F7898F26145867EF2672603D54A5CC451DB5623FC68A436FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2