Extracted

• • Target
    cff43a7cfc64e0f62b575bc5cf1d9c04869f427336e98cf7ae8e475708f93151
  • Size 45KB
  • SHA256 cff43a7cfc64e0f62b575bc5cf1d9c04869f427336e98cf7ae8e475708f93151
  • MD5 91705dc9621240a62354e5ad142974f4
  • SHA1 a0bd8815b5918ec710da322019aa633c266a7d38
  • SHA512 8e1374d2b20ac16c04a806e730eb68644ccff4a7b72ceea6ef669c53f6e7a8e14ca98bf31c73b595928bfb1446ae20b01bdbb45d472c0041812477080eb392b8
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFV7lH440WMOPI0kzjbLgXei71dcP1wyNBDZUx:cu7e5TH2A2QqUM30k3b0Xn7lAdUx
  • TLSH
    T1BF231A003BE8C12BF2BE4F7899F26145867AF6737603D54A1CC452DB5613BC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2