Extracted

• • Target
    9f193c1d9fd53634ca671ff4dd3a37e3c8516d6dd1c903a23272e90bae0e6ef4
  • Size 45KB
  • SHA256 9f193c1d9fd53634ca671ff4dd3a37e3c8516d6dd1c903a23272e90bae0e6ef4
  • MD5 8faed5c07d8b2515de748a8f1b9e759f
  • SHA1 a14fc84a321a1542a2e81da9382d0def08712101
  • SHA512 13276eff2e95832955fac20208b992324dbcd01b17db41bb1d83878f512b33ef672e071115bd936ee8ad5213f2ea062bce67229c20e6d37eca824c14c39da3bf
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYsHO9YjoHPICYzjbSgX3iA+hogBDZ0x:8uuSpTgyf2h6kgCY3bVXSAz2d0x
  • TLSH
    T198231A003BE8C12BF2BE4F74A9F26145467AF6633A03D5891CC451D75623FC6DA42AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2