Extracted

• • Target
    9fabe48b61140c341ee8d5980a345c3e7de5b33bd23fcebc4dd4c298e0f9419c
  • Size 45KB
  • SHA256 9fabe48b61140c341ee8d5980a345c3e7de5b33bd23fcebc4dd4c298e0f9419c
  • MD5 91ab815c9938325d7c9493a71d7e8698
  • SHA1 402dc12c5232eb6c61be6e5c89b24b08eee8df69
  • SHA512 c7843be4a8d1603a2ba1df3552c5ced5e6a885409a1ab3daa9dea01778040b3cac5e2e0b25b506f6df08e01976d0238b27ca0c20cb2ae96ef3c050f878ce4fc7
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNyqAYaayNPIHzjblgX3NupMsTrFwQxyBDZ0x:5uSy6pTpoo2/qzqqH3biX9upFdwQOd0x
  • TLSH
    T101231A103BE8822BF2BE4F78A9F26145867AF2633603D5491CC451DB5713FC69642AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2