Extracted

• • Target
    9a39abc5fcfac64e53ae2094460437d38eedcf189a327298f99f9e2b4941b5b0
  • Size 45KB
  • SHA256 9a39abc5fcfac64e53ae2094460437d38eedcf189a327298f99f9e2b4941b5b0
  • MD5 db39328d3fd87c0a0076f4146caf614c
  • SHA1 c9b9250ec47cce9b366b09da88a3dfabd9d9264a
  • SHA512 c9be57f301914320217483c3ac9176499f8a90fd07ee40e0ce039e4c0d6340c9c92e72f29aaf7e3f9fd339dc408d007d715e6f3c2e6ef927082c53bc155ca9f4
  • SSDEEP 768:4uLZZTUAoOSWUYZL8mo2qFe3XoPEayPIjzjbfgX3inRbLVBfu0BDZbx:4uLZZTUTn29mEabj3boXSnRbZBtdbx
  • TLSH
    T171232A003BE8822BF2BE4F789CF26145467AF6636603D58D2CC451DB5713BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2