Extracted

• • Target
    9f0911c25cffca76e7538aa478ef583ac42c69f53e3fb92cd0a014ef30f29bf5
  • Size 45KB
  • SHA256 9f0911c25cffca76e7538aa478ef583ac42c69f53e3fb92cd0a014ef30f29bf5
  • MD5 057c0d8a1374e5b7d843d036f3f9d1f6
  • SHA1 33391fd7bd9642a411aae16f126fb6ee3727e302
  • SHA512 76b836e21b58762717d4adce47270fe6c44e41da2510348d2bf5382e11be4b8857b699202467b329b488c4197ae9ee9cac3b19224bba1dcfceaa0a8dcd030a63
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9K9Yikq/ztOPIYzjbfgc3ifmEeFlQ7R6DCVn1poBDZ+:0uPrpT/qY23ali3Y3bocSl9zVn14d8x
  • TLSH
    T139232A003BE9C12BF2BE8F789DF26205467AF6632603D6491CC452DB5613FC68A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2