Extracted

• • Target
    ccedba955b1c5c8c46f99d5f61cc73ed23aa010c566f4e700f5c04fa69c30331
  • Size 45KB
  • SHA256 ccedba955b1c5c8c46f99d5f61cc73ed23aa010c566f4e700f5c04fa69c30331
  • MD5 2f81a88bd839321e680a5f6e7c1fa4ff
  • SHA1 4d98c43252e9f2d02973403f0bdf52b0e0e9fade
  • SHA512 7307b02a0b40a84c10da43f1827c84d12a06ffe51b659e2041cbc68c231e78a93bc1fc91558232aec5be5c4569911107dce8e9a3773f86589c29cf1ff9ab217b
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1GxJdxrPHuPIbzjb3gI3iCirX4YtkOc4lGBDZcx:RuxkJTgip2zxR3b3bQISDX4YtiEIdcx
  • TLSH
    T103232B003BE9C62BF2BE4F7499F26245467AF2636603D54D2CC451DB1623FC6CA426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2