Extracted

• • Target
    cb37229c2d2ae83768a401ddb378ad09feceedb6f288a75b9299fdf1c258f1e5
  • Size 45KB
  • SHA256 cb37229c2d2ae83768a401ddb378ad09feceedb6f288a75b9299fdf1c258f1e5
  • MD5 c5d2115f0abda6921f2a7ad10676fe48
  • SHA1 6856e55f3d9f99eede7d8a359e66b284850441f5
  • SHA512 09b6d7dfe90c61f67cd256965eb81f0c2bb68a1386af2ee261ce243d46f51492f125b8c15c30684bb1c086c67a2d3f15ec5e7f00c1435858dfe314a4a12b416f
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFV7lt440WMOPI0szjbsgXbiHqZyXHxMhE3hfS3XYX2:cu7e5TH2A2QgUM30s3bjX2SyqkgYRdUx
  • TLSH
    T143232A003BE8812BF2BE5F7899F26245867AF6732603D54A1CC452D75713FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2