Extracted

• • Target
    cc50905247e1f36e2f755db2468ac7c54d9b7d4ffe63ab3797634c7891728503
  • Size 45KB
  • SHA256 cc50905247e1f36e2f755db2468ac7c54d9b7d4ffe63ab3797634c7891728503
  • MD5 d68c2f98878caa1eb2c4e8115d26468b
  • SHA1 393fd704f3dccff6941e816ea7530bbe937df8c7
  • SHA512 3f759478c8489fee7819c2164240b61ef13de48fb085e8df122afa013f85d077739e4ef362de59a2d4b4f9420ecbaf1fb84d3f97f952810f1a9176f3f86f472f
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4wOqwwiKqNjPICzjbFgX37xvJlKt95QP9nl2zwcBU:8uUIpT4vAj20OqLKKC3bCXLjQt9mRlWU
  • TLSH
    T166233B103BE9822BF2BF5F7498F22145867AF6633603D9492CC451DB4723FC69642AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2