Extracted

• • Target
    9a0e9701b597c5f461adaff9bd6e86e5774de86e627a7fb619d0347989a8bb43
  • Size 45KB
  • SHA256 9a0e9701b597c5f461adaff9bd6e86e5774de86e627a7fb619d0347989a8bb43
  • MD5 41c663de5f0e3ecd3ef8d495426b3f33
  • SHA1 4707218b4f1ce6233bd22406ac18ddc6b5130231
  • SHA512 81ece5b633c75ed8e63840bb08d548b30b99c6583b40fca0a4c4a5a6f6c3803959d6b007ba7c783b834da5087696b2c12cc6e0755ca65a9bc0384000b4137e61
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q94K1HJCOPIcazjbngY3iMX4LSaunrXNpHBDZsx:EulCJTHl42qFA3ca3bgYSMX4LBu7Nrdu
  • TLSH
    T114231A0037E8822BF2BE4F7499F26145867EB6633603E58E1CC442DB5613FC59A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2