Extracted

• • Target
    9f40a8fd0d141128f913885bd0560dd1aca4e829532d18d3e944ccf60cc04cc5
  • Size 45KB
  • SHA256 9f40a8fd0d141128f913885bd0560dd1aca4e829532d18d3e944ccf60cc04cc5
  • MD5 8679f89a93bcab28052bc6af2a320802
  • SHA1 d92bb465ac0e33096a7a4305bbea7a0958b6e439
  • SHA512 3cad2da057bef4d748cabddbfd087bc902990afe49785a0a6ee9768374ae68a3b2accac83d967ba10007d0c9f8d7c0f1f2e748d895e884762f7dad1ae8d96e36
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1fLiE0yFjrdj3kk8PIhpjbAgX3iS5x/Ag5hO9sTsBDg:cuR0JTPjY2SLBXDBhJbnXSCx4g5hTTq0
  • TLSH
    T1F3232A0037E9812BF2BE4BB86DF26145467AF6733603D64A1CC451DB5A23BC686426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2