Extracted

• • Target
    9336eb452d8fc7b506622585401c7ccec50654f6bcf9b16f1d44d5c03e8e72cc
  • Size 45KB
  • SHA256 9336eb452d8fc7b506622585401c7ccec50654f6bcf9b16f1d44d5c03e8e72cc
  • MD5 9d42459be20ad98d289feb7308a47e36
  • SHA1 a138ee316e851b04807217bc9b708a91f76af593
  • SHA512 652021bb83dfdf44361ec7f6d6542c9f7107ba3fb821df2f2a0c071954d5b912522b31c1eb228dee2d8beea6290a04c1670de567f8544eb52f973526426e2f93
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNK9wa0y/zFOPIuzjb5gQ3iDIxbETyD/7TxBDZ0x:5uSy6pTpoo2HCdi3u3bWQSExQODTzd0x
  • TLSH
    T139233A003BE9822BF2BF5B789CF26245867AB5733503D64A1CC451DB5713BC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2