Extracted

• • Target
    b9d3d7e254b6c024fb4295dec9c3ab5b4335654af727f86918cced25ffd934bb
  • Size 45KB
  • SHA256 b9d3d7e254b6c024fb4295dec9c3ab5b4335654af727f86918cced25ffd934bb
  • MD5 5e042fc24fc8a6cac5f6dd0167d3f31a
  • SHA1 c78f29ae5408418a5c9ddfda76841b2a99f574ea
  • SHA512 f47acdca9e715f3f3ff24abf88c36140075f956d41a1f7e5f850ce90314d3ed89fa2c1d5c171be8a1cded579a93cbcfcd04f6b5caf996c2897ca8d63beba2e59
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVT/qpG3jHuPIszjbdgXGiObc+Wk2g14Xh5bIBDZkx:suJdpTPdI2WIM3s3bKXvObXWk2a4Xh51
  • TLSH
    T10A232B003BE8812BF2BE4FB8A8F26145457AF1637602D64D2CC452DB5623FC6DA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2