Extracted

• • Target
    cdc653b5f78e728d60cbd469030f81f6ac4ec1d229c0d5076638f00d12d194a4
  • Size 45KB
  • SHA256 cdc653b5f78e728d60cbd469030f81f6ac4ec1d229c0d5076638f00d12d194a4
  • MD5 108c17fc37d855d170a23a7e95828317
  • SHA1 72a06b927388e69831e2767dd1eba4436e0cda00
  • SHA512 c032833a8f78b061111ab90e92ff4d6e68592a6d8e86bc18df6ccc5cf33765d4e0fe22affa8bf614e9576c4a13b7933dce02ba19cf65945aec8b2a65534a61d9
  • SSDEEP 768:HuCIJTQc5fVWUhxlDmo2qrm0UwPOlehAPITpzjbygX3iWVenKxIMsBDZYx:HuCIJTQmX250/OghlTp3b1XSKeKOMqdK
  • TLSH
    T1E7232B003BE9813BF2BE4F7899F26105467AF2677603D64A1CC451DB5723BC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2